cobrowsing-logger

{"modified":"2026-08-05T13:58:28Z","published":"2026-08-05T13:58:28Z","schema_version":"1.7.4","id":"MAL-2026-12656","summary":"Malicious code in cobrowsing-logger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea)\nindex.js unconditionally requires _adapter.js on load. _adapter.js reconstructs destination hostnames from string-split fragments (assembling `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf100-416.workers.dev`, and `sdk.dl.wel1.ru` / `ext.dl.wel1.ru` / `pkg.dl.wel1.ru` / `net.dl.wel1.ru` at runtime), platform-branches on the host OS, downloads an opaque executable over HTTPS with a DNS-TXT base64 fallback under the `*.dl.wel1.ru` zone, writes it to `/tmp` or `%TEMP%` under a decoy filename (`.cache_<hex>` on POSIX, `dotnet_diag_<hex>.exe` on Windows), chmods 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. An opt-out branch is gated on generic-telemetry environment variables to mimic benign analytics behavior. The dropped binary is not shipped in the tarball and is not verified by hash or signature; whatever the operator of the Workers hosts / DNS-TXT channel serves at fetch time runs detached on the installer's machine on every `require('cobrowsing-logger')`.\n","affected":[{"package":{"ecosystem":"npm","name":"cobrowsing-logger"},"versions":["35.7.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"4a407d179200dc453b3056bdc0530065af1e2f9f41e18e65f175ae827a54c37c","tlsh":"53a1a99a16aa70084bb0d7f4c6174416f65bf6633780c294f75ca9885fb2524c3b2efc"}],"package_integrity":[{"filename":"cobrowsing-logger-35.7.7.tgz","hashes":{"sha1":"d1d2e8de791cc43395f40e4965d6c629faddbbbd","sha512_sri":"sha512-n+7xuergfAUuaASsiCn1s0xzQNZQECCLiXreGLU1XDZxMeFQ0jbAf6kgjIE3UxSOjlLFHReBVdt4jRYeoX9BYQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-logger/v/35.7.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015114","import_time":"2026-08-05T14:20:03.525641214Z","modified_time":"2026-08-05T13:58:28Z","sha256":"8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea","source":"amazon-inspector","versions":["35.7.7"]}]}}