cobrowsing-cobrowsing-core

{"modified":"2026-08-05T13:59:23Z","published":"2026-08-05T13:59:23Z","schema_version":"1.7.4","id":"MAL-2026-12651","summary":"Malicious code in cobrowsing-cobrowsing-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9)\ncobrowsing-cobrowsing-core@35.5.8 is a binary dropper disguised as a platform core package. On require()/import (index.js loads _polyfill.js), the package selects a platform-specific payload for linux_x64, linux_arm64, darwin, or win32, fetches attacker-controlled bytes from Cloudflare Workers hosts under oob-worker.cf1xx-*.workers.dev, writes them to /var/tmp or %TEMP% under a disguised name (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmods to 0755, and spawns them detached via /bin/sh -c or cmd.exe. No signature or hash verification is performed. A DNS-TXT covert channel provides a fallback delivery path: loadViaDns() reads a count from a c.<domain> TXT record, then concatenates N numbered TXT records from sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-decodes the result, and executes it. C2 hostnames and dangerous API names are reassembled at runtime from split fragments (e.g. [\"oob-worker.cf103-070.w\",\"ork\",\"ers.\",\"dev\"].join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) as anti-scanner obfuscation. lib/telemetry.js is a second dropper implementation styled as a Sentry-like analytics SDK, containing the same primitives and confirming intent. Any consumer that installs and require()s this package executes attacker-controlled code on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"cobrowsing-cobrowsing-core"},"versions":["35.5.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"5cba9994c402a51d91247bac24a0204d4812ba437aaa741da4fc3b1584f51d5c","tlsh":"5da1879a026b71198bb0d7e4c7175416f65bf663338082d8fa5c69981fb312443b2efc"},{"path":"lib/telemetry.js","sha256":"f8b93e1d8ca5d015682184bcf24972a80fbf71cf60b2fe5cfecda0fa93f03eee","tlsh":"b2835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"cobrowsing-cobrowsing-core-35.5.8.tgz","hashes":{"sha1":"8ae1482ef0dc51f350f5ea30d134f91289de0050","sha512_sri":"sha512-Rb+0jiW9xPENm2MCBypgGAxs2U9xOjE3XS5MuE0t+s/x826FANt/pEI/qwtHbI/7y4uOdg87dt7DvanFdeZocg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-cobrowsing-core/v/35.5.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015120","import_time":"2026-08-05T14:20:04.106735242Z","modified_time":"2026-08-05T13:59:23Z","sha256":"c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9","source":"amazon-inspector","versions":["35.5.8"]}]}}