MAL-2026-12652 Malicious code in cobrowsing-configs (npm)

On require() of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback channel under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The fetched bytes are written to /tmp or %TEMP% under deceptive names impersonating system artifacts (e.g., dotnet_diag.exe,.cache_), chmod 0755 on Unix, and executed detached via spawn("/bin/sh", ["-c",…]) or spawn("cmd",…). No hash or signature verification is performed, and the fetched binary is unrelated to the package's stated purpose of loading configuration. The behavior fires as a side effect of importing the module, giving whoever controls the C2 hosts arbitrary code execution on any machine that installs and loads the package.