{"id":"MAL-2026-12656","summary":"Malicious code in cobrowsing-logger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea)\nindex.js unconditionally requires _adapter.js on load. _adapter.js reconstructs destination hostnames from string-split fragments (assembling `oob-worker.cf99-9b3.workers.dev`, `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf100-416.workers.dev`, and `sdk.dl.wel1.ru` / `ext.dl.wel1.ru` / `pkg.dl.wel1.ru` / `net.dl.wel1.ru` at runtime), platform-branches on the host OS, downloads an opaque executable over HTTPS with a DNS-TXT base64 fallback under the `*.dl.wel1.ru` zone, writes it to `/tmp` or `%TEMP%` under a decoy filename (`.cache_\u003chex\u003e` on POSIX, `dotnet_diag_\u003chex\u003e.exe` on Windows), chmods 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe`. An opt-out branch is gated on generic-telemetry environment variables to mimic benign analytics behavior. The dropped binary is not shipped in the tarball and is not verified by hash or signature; whatever the operator of the Workers hosts / DNS-TXT channel serves at fetch time runs detached on the installer's machine on every `require('cobrowsing-logger')`.\n","modified":"2026-08-05T14:36:10.717434587Z","published":"2026-08-05T13:58:28Z","database_specific":{"malicious-packages-origins":[{"versions":["35.7.7"],"id":"IN-MAL-2026-015114","import_time":"2026-08-05T14:20:03.525641214Z","modified_time":"2026-08-05T13:58:28Z","sha256":"8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cobrowsing-logger/v/35.7.7"}],"affected":[{"package":{"name":"cobrowsing-logger","ecosystem":"npm","purl":"pkg:npm/cobrowsing-logger"},"versions":["35.7.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"53a1a99a16aa70084bb0d7f4c6174416f65bf6633780c294f75ca9885fb2524c3b2efc","path":"_adapter.js","sha256":"4a407d179200dc453b3056bdc0530065af1e2f9f41e18e65f175ae827a54c37c"}],"package_integrity":[{"filename":"cobrowsing-logger-35.7.7.tgz","hashes":{"sha512_sri":"sha512-n+7xuergfAUuaASsiCn1s0xzQNZQECCLiXreGLU1XDZxMeFQ0jbAf6kgjIE3UxSOjlLFHReBVdt4jRYeoX9BYQ==","sha1":"d1d2e8de791cc43395f40e4965d6c629faddbbbd"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cobrowsing-logger/MAL-2026-12656.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}