cobrowsing-configs

{"modified":"2026-08-05T14:00:34Z","published":"2026-08-05T14:00:34Z","schema_version":"1.7.4","id":"MAL-2026-12652","summary":"Malicious code in cobrowsing-configs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558)\nOn require() of cobrowsing-configs, index.js loads _polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback channel under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under deceptive names impersonating system artifacts (e.g., dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and executed detached via spawn(\"/bin/sh\", [\"-c\",...]) or spawn(\"cmd\",...). No hash or signature verification is performed, and the fetched binary is unrelated to the package's stated purpose of loading configuration. The behavior fires as a side effect of importing the module, giving whoever controls the C2 hosts arbitrary code execution on any machine that installs and loads the package.\n","affected":[{"package":{"ecosystem":"npm","name":"cobrowsing-configs"},"versions":["35.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"31e7bf9b543fe08ba5bab33da0661c7036a07c4f345d4d40d4c9a38676a89866","tlsh":"68a1965a166b70188bb097e4c7174416f65ae6633781c1c8fb9ca9985f73114c3b2efc"}],"package_integrity":[{"filename":"cobrowsing-configs-35.7.5.tgz","hashes":{"sha1":"1e6314e66f9dc0f9f64cc98a2957ced9eeb1ac69","sha512_sri":"sha512-z9JXFU0t9unBuZQ6Mi4nnBjM/cI6ovTlAGf+FsNWaH+nmV03+94/Zs2kfb6H8TvYLH7fcLG1aWgpG7kcdc8V4w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-configs/v/35.7.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015127","import_time":"2026-08-05T14:20:04.805521806Z","modified_time":"2026-08-05T14:00:34Z","sha256":"45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558","source":"amazon-inspector","versions":["35.7.5"]}]}}