MAL-2026-12657

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-redis-module/MAL-2026-12657.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12657
Published
2026-08-05T13:57:25Z
Modified
2026-08-05T14:36:11.025913190Z
Summary
Malicious code in cobrowsing-redis-module (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6)

index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split string arrays (e.g. ["oob-worker.cf99-9b3.workers",".d","ev"].join("")) pointing at oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, downloads bytes via https.get, writes them to /var/tmp or %TEMP% under disguised names (dotnetdiag<hex>.exe on Windows,.cache<hex> on POSIX), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe. When HTTPS fails, a DNS-TXT covert channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reassembles the payload from base64 TXT chunks (c.<domain> for chunk count, <i>.<domain> for each chunk) via Buffer.from(...,'base64'). No hash or signature verification is performed. A.analyticsstate stamp file and DISABLETELEMETRY / ANALYTICSOPTOUT / DONOT_TRACK env-var gates are used as cover-story framing; the destinations and behavior are unrelated to any Redis or cobrowsing functionality. The package name and README present it as an internal Redis wrapper while the sibling _loader.js contains only the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.4.7"
            ],
            "id": "IN-MAL-2026-015107",
            "import_time": "2026-08-05T14:20:02.747749987Z",
            "modified_time": "2026-08-05T13:57:25Z",
            "source": "amazon-inspector",
            "sha256": "502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6"
        }
    ]
}
References
Credits

Affected packages

npm / cobrowsing-redis-module

Package

Name
cobrowsing-redis-module
View open source insights on deps.dev
Purl
pkg:npm/cobrowsing-redis-module

Affected ranges

Affected versions

35.*
35.4.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "cobrowsing-redis-module-35.4.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-K4pkH/3b1k+9Uk03Bj5IIn68xqiQDx7O8nfzXWapsI3Fcg98evM07B99UaVMeQ3060b5rCGUF4jI90Jdg/LkFQ==",
                "sha1": "9712d4cb1b575991a6dc2c4c3bbb3fbee9efa63b"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_loader.js",
            "tlsh": "c3a1646a166a71084bb0ebf4ca274416f55bf6633780c684f79c69885f7252482b2efc",
            "sha256": "4b7de7781d520e482340fd228ca9334eb8e8037bc67df6feaebc8395837d4dff"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-redis-module/MAL-2026-12657.json"