cobrowsing-test-utils

{"modified":"2026-08-05T13:57:15Z","published":"2026-08-05T13:57:15Z","schema_version":"1.7.4","id":"MAL-2026-12658","summary":"Malicious code in cobrowsing-test-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de)\ncobrowsing-test-utils@35.3.4 executes a full-host dropper on require(). index.js loads _support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays (Cloudflare Workers subdomains under workers.dev and DNS resolver domains under dl.wel1.ru), downloads a platform-specific native binary over HTTPS with a DNS TXT-record fallback, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. There is no version pinning, no signature or hash verification, and the fetched binary is unrelated to the package's stated 'common helpers' purpose. Cover-story identifiers such as 'analytics_state' and 'DISABLE_TELEMETRY' do not correspond to the observed behavior. A companion module lib/telemetry.js ships the same fetch/base64-decode/chmod-0755/spawn('/bin/sh','-c', path+' &') primitives under Sentry-style analytics-SDK boilerplate. Hostname obfuscation via runtime string joining (e.g., ['sdk.d','l.wel1','.r','u'].join('') and ['oob-worker.cf','...','workers','.de','v'].join('')) is a deliberate evasion of static analysis and is inconsistent with legitimate telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"cobrowsing-test-utils"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"86abf36fd530e7404eb7bb44c28e85141a4f8465845121a5051677900e8c2598","tlsh":"41a1845a156a70198bb0e7e0c717581af65af663338082d8f75c65980fb712883b2efc"},{"path":"lib/telemetry.js","sha256":"d5dd5a288b6a77cbf7cb2746e8d00d7bb7365d3024e54dcde33a8a7256c90bf9","tlsh":"06835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"cobrowsing-test-utils-35.3.4.tgz","hashes":{"sha1":"7c709d490dde228e52520f4dff3bf05d73f360d4","sha512_sri":"sha512-D6OOcVz/vZfHRc5+gesoxpheASYHJASvgg54G68XjdOFjosmFF/q3n9t2TwiCMrIstlwnKJHUzHGsspfA7J9Lw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-test-utils/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015106","import_time":"2026-08-05T14:20:02.62747339Z","modified_time":"2026-08-05T13:57:15Z","sha256":"d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de","source":"amazon-inspector","versions":["35.3.4"]}]}}