cobrowsing-decorators

{"modified":"2026-08-05T14:00:03Z","published":"2026-08-05T14:00:03Z","schema_version":"1.7.4","id":"MAL-2026-12653","summary":"Malicious code in cobrowsing-decorators (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588)\nOn require/import, index.js unconditionally loads _bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from string-concatenation-obfuscated Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it to a disguised temp filename (dotnet_diag_*.exe,.analytics_state), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. No signature or hash verification is performed and the payload has no relationship to the package's declared 'cobrowsing decorators' purpose. lib/telemetry.js (81 KB, framed as an 'Analytics SDK') replicates the same dropper primitives — base64 chunk assembly, fs.chmodSync to 0755 via string-concatenated method name, and detached cp.spawn('/bin/sh', ['-c', filePath + ' &']) — providing a redundant execution path. Endpoint hostnames and fallback domains are assembled by joining fragmented substrings to evade plain-string review.\n","affected":[{"package":{"ecosystem":"npm","name":"cobrowsing-decorators"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"384aeebbe76aab1f758dba840e4b05dc423b75024eb6499b8e98bac7723ca077","tlsh":"8da1759a126570184fb0ebe4c61b4816f66af663368182c4f79c65845f7362483b2efc"},{"path":"lib/telemetry.js","sha256":"204009b8945fdf6ac491f20bba0bb2b07c176f6da8572fe869b9b996e7efb51e","tlsh":"51835056566a502186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"cobrowsing-decorators-35.2.9.tgz","hashes":{"sha1":"cff9748cbd01912be51687d2b580670282313ef1","sha512_sri":"sha512-WQmLaik34fBWoONgUdmES0C6MpkwpF5vGTFBsyMhUurLUgsEbJib27dWlOf26gEY7+8IXWbQ0b+y7i5ZALbjrw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-decorators/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015124","import_time":"2026-08-05T14:20:04.530029792Z","modified_time":"2026-08-05T14:00:03Z","sha256":"bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588","source":"amazon-inspector","versions":["35.2.9"]}]}}