MAL-2026-12658

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-test-utils/MAL-2026-12658.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12658
Published
2026-08-05T13:57:15Z
Modified
2026-08-05T14:36:11.503409639Z
Summary
Malicious code in cobrowsing-test-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de)

cobrowsing-test-utils@35.3.4 executes a full-host dropper on require(). index.js loads support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays (Cloudflare Workers subdomains under workers.dev and DNS resolver domains under dl.wel1.ru), downloads a platform-specific native binary over HTTPS with a DNS TXT-record fallback, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. There is no version pinning, no signature or hash verification, and the fetched binary is unrelated to the package's stated 'common helpers' purpose. Cover-story identifiers such as 'analyticsstate' and 'DISABLETELEMETRY' do not correspond to the observed behavior. A companion module lib/telemetry.js ships the same fetch/base64-decode/chmod-0755/spawn('/bin/sh','-c', path+' &') primitives under Sentry-style analytics-SDK boilerplate. Hostname obfuscation via runtime string joining (e.g., ['sdk.d','l.wel1','.r','u'].join('') and ['oob-worker.cf','...','workers','.de','v'].join('')) is a deliberate evasion of static analysis and is inconsistent with legitimate telemetry.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015106",
            "import_time": "2026-08-05T14:20:02.62747339Z",
            "sha256": "d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de",
            "modified_time": "2026-08-05T13:57:15Z",
            "versions": [
                "35.3.4"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / cobrowsing-test-utils

Package

Name
cobrowsing-test-utils
View open source insights on deps.dev
Purl
pkg:npm/cobrowsing-test-utils

Affected ranges

Affected versions

35.*
35.3.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-D6OOcVz/vZfHRc5+gesoxpheASYHJASvgg54G68XjdOFjosmFF/q3n9t2TwiCMrIstlwnKJHUzHGsspfA7J9Lw==",
                "sha1": "7c709d490dde228e52520f4dff3bf05d73f360d4"
            },
            "filename": "cobrowsing-test-utils-35.3.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "sha256": "86abf36fd530e7404eb7bb44c28e85141a4f8465845121a5051677900e8c2598",
            "tlsh": "41a1845a156a70198bb0e7e0c717581af65af663338082d8f75c65980fb712883b2efc"
        },
        {
            "sha256": "d5dd5a288b6a77cbf7cb2746e8d00d7bb7365d3024e54dcde33a8a7256c90bf9",
            "path": "lib/telemetry.js",
            "tlsh": "06835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-test-utils/MAL-2026-12658.json"