bigops-cobrowsing

{"modified":"2026-08-05T08:47:24Z","published":"2026-08-05T08:47:24Z","schema_version":"1.7.4","id":"MAL-2026-12159","summary":"Malicious code in bigops-cobrowsing (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379)\nOn require of the package's main entry, _compat.js selects a per-OS asset path and downloads a native binary from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT-record fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru to obtain a substitute host. The fetched bytes are written to a temp path under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and executed detached via spawn(\"cmd\",...) or spawn(\"/bin/sh\", [\"-c\", fp+\" &\"]). Destination hostnames are reassembled at runtime via array.join(\"\") string-split obfuscation (e.g. [\"oob-worker.cf99-9b3.workers\",\".de\",\"v\"].join(\"\"); ['sdk.dl.wel','1.r','u'].join(\"\")). No publisher-matching source, no version pin, no hash/signature verification; declared purpose is a cobrowsing library, which does not require fetching and executing an opaque native binary from anonymous infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"bigops-cobrowsing"},"versions":["35.4.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"1777cd6e60db325088b0c189220890625b7b820a94f236ceeb9607a875064ca4","tlsh":"4ea1759a126a70194bb0abe48717441af65bf6633380c284fb5ca5d45f7326482b2efc"}],"package_integrity":[{"filename":"bigops-cobrowsing-35.4.9.tgz","hashes":{"sha1":"8bc92bb01dc2faf23e94c3fded3076e253f4f338","sha512_sri":"sha512-HDEk/3MyOu6JkBcWijfKxhv/4UoT4zAAIngsV6IlGvhIex1VCar2/hFMv9WCYwHxOwY6Jis/iG5IQ0YSQ+mbJA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-cobrowsing/v/35.4.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014417","import_time":"2026-08-05T09:28:08.856146701Z","modified_time":"2026-08-05T08:47:24Z","sha256":"e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379","source":"amazon-inspector","versions":["35.4.9"]}]}}