MAL-2026-12159 Malicious code in bigops-cobrowsing (npm)

On require of the package's main entry, compat.js selects a per-OS asset path and downloads a native binary from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT-record fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru to obtain a substitute host. The fetched bytes are written to a temp path under a disguised name (dotnet_diag<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and executed detached via spawn("cmd",…) or spawn("/bin/sh", ["-c", fp+" &"]). Destination hostnames are reassembled at runtime via array.join("") string-split obfuscation (e.g. ["oob-worker.cf99-9b3.workers",".de","v"].join(""); ['sdk.dl.wel','1.r','u'].join("")). No publisher-matching source, no version pin, no hash/signature verification; declared purpose is a cobrowsing library, which does not require fetching and executing an opaque native binary from anonymous infrastructure.