{"id":"MAL-2026-12159","summary":"Malicious code in bigops-cobrowsing (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379)\nOn require of the package's main entry, _compat.js selects a per-OS asset path and downloads a native binary from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT-record fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru to obtain a substitute host. The fetched bytes are written to a temp path under a disguised name (dotnet_diag_\u003crand\u003e.exe on Windows,.cache_\u003crand\u003e on Unix), chmod 0755, and executed detached via spawn(\"cmd\",...) or spawn(\"/bin/sh\", [\"-c\", fp+\" &\"]). Destination hostnames are reassembled at runtime via array.join(\"\") string-split obfuscation (e.g. [\"oob-worker.cf99-9b3.workers\",\".de\",\"v\"].join(\"\"); ['sdk.dl.wel','1.r','u'].join(\"\")). No publisher-matching source, no version pin, no hash/signature verification; declared purpose is a cobrowsing library, which does not require fetching and executing an opaque native binary from anonymous infrastructure.\n","modified":"2026-08-05T10:05:58.191950230Z","published":"2026-08-05T08:47:24Z","database_specific":{"malicious-packages-origins":[{"sha256":"e81463953e6dde1f029deb6a15345c1f0e1a763e59c2f52e821c8e6f2d62f379","source":"amazon-inspector","versions":["35.4.9"],"id":"IN-MAL-2026-014417","import_time":"2026-08-05T09:28:08.856146701Z","modified_time":"2026-08-05T08:47:24Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigops-cobrowsing/v/35.4.9"}],"affected":[{"package":{"name":"bigops-cobrowsing","ecosystem":"npm","purl":"pkg:npm/bigops-cobrowsing"},"versions":["35.4.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigops-cobrowsing/MAL-2026-12159.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"8bc92bb01dc2faf23e94c3fded3076e253f4f338","sha512_sri":"sha512-HDEk/3MyOu6JkBcWijfKxhv/4UoT4zAAIngsV6IlGvhIex1VCar2/hFMv9WCYwHxOwY6Jis/iG5IQ0YSQ+mbJA=="},"filename":"bigops-cobrowsing-35.4.9.tgz"}],"evidence_files":[{"path":"_compat.js","sha256":"1777cd6e60db325088b0c189220890625b7b820a94f236ceeb9607a875064ca4","tlsh":"4ea1759a126a70194bb0abe48717441af65bf6633380c284fb5ca5d45f7326482b2efc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}