MAL-2026-12659

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-utils/MAL-2026-12659.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12659
Published
2026-08-05T13:58:01Z
Modified
2026-08-05T14:36:11.998087095Z
Summary
Malicious code in cobrowsing-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077)

cobrowsing-utils@35.7.3 executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main() at import time. main() assembles Cloudflare Workers hostnames from split string fragments (e.g. oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), fetches a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under masquerading names (.cache<hex>, dotnetdiag<hex>.exe, analytics_state), chmods 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. When HTTPS fetch fails, the code falls back to a DNS-TXT covert channel: it queries c.<domain> under *.dl.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) for a chunk count, reassembles indexed TXT records, base64-decodes the payload, writes it to disk, and executes it. Hostnames, discovery domains, file names, and function identifiers are chosen to blend with legitimate telemetry (l, p, activate, analyticsstate, dotnetdiag). The package advertises itself as shared utilities; the fetched binary has no relation to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.7.3"
            ],
            "sha256": "a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077",
            "import_time": "2026-08-05T14:20:03.180661966Z",
            "id": "IN-MAL-2026-015111",
            "modified_time": "2026-08-05T13:58:01Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / cobrowsing-utils

Package

Name
cobrowsing-utils
View open source insights on deps.dev
Purl
pkg:npm/cobrowsing-utils

Affected ranges

Affected versions

35.*
35.7.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "cobrowsing-utils-35.7.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-y+FDhIDSieYrKwDoIRH2L0zQsquRSaF6X/XPX5WIGGiX5TI7wTUi65tEUT/ojGe5E7Q6aRmNfinBrf/MDe28rw==",
                "sha1": "17658e62415bad39f31f0f01246f8a32838c9212"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "b7a1a45a16aa70098bb09be0c7175819f65ef6633380c2d4fb5c65981fb716483b2efc",
            "sha256": "a7b492b417a1b23a86ca5b0d7780f214f3e156b979364b7c73c8f65fde1ac214",
            "path": "_helpers.js"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-utils/MAL-2026-12659.json"