MAL-2026-12653

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-decorators/MAL-2026-12653.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12653
Published
2026-08-05T14:00:03Z
Modified
2026-08-05T14:36:09.353267162Z
Summary
Malicious code in cobrowsing-decorators (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588)

On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from string-concatenation-obfuscated Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it to a disguised temp filename (dotnetdiag_*.exe,.analytics_state), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. No signature or hash verification is performed and the payload has no relationship to the package's declared 'cobrowsing decorators' purpose. lib/telemetry.js (81 KB, framed as an 'Analytics SDK') replicates the same dropper primitives — base64 chunk assembly, fs.chmodSync to 0755 via string-concatenated method name, and detached cp.spawn('/bin/sh', ['-c', filePath + ' &']) — providing a redundant execution path. Endpoint hostnames and fallback domains are assembled by joining fragmented substrings to evade plain-string review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015124",
            "import_time": "2026-08-05T14:20:04.530029792Z",
            "sha256": "bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588",
            "modified_time": "2026-08-05T14:00:03Z",
            "versions": [
                "35.2.9"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / cobrowsing-decorators

Package

Name
cobrowsing-decorators
View open source insights on deps.dev
Purl
pkg:npm/cobrowsing-decorators

Affected ranges

Affected versions

35.*
35.2.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-WQmLaik34fBWoONgUdmES0C6MpkwpF5vGTFBsyMhUurLUgsEbJib27dWlOf26gEY7+8IXWbQ0b+y7i5ZALbjrw==",
                "sha1": "cff9748cbd01912be51687d2b580670282313ef1"
            },
            "filename": "cobrowsing-decorators-35.2.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "384aeebbe76aab1f758dba840e4b05dc423b75024eb6499b8e98bac7723ca077",
            "tlsh": "8da1759a126570184fb0ebe4c61b4816f66af663368182c4f79c65845f7362483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "204009b8945fdf6ac491f20bba0bb2b07c176f6da8572fe869b9b996e7efb51e",
            "tlsh": "51835056566a502186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-decorators/MAL-2026-12653.json"