MAL-2026-12653 Malicious code in cobrowsing-decorators (npm)

On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from string-concatenation-obfuscated Cloudflare Workers endpoints (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it to a disguised temp filename (dotnet_diag*.exe,.analytics_state), chmods it 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. No signature or hash verification is performed and the payload has no relationship to the package's declared 'cobrowsing decorators' purpose. lib/telemetry.js (81 KB, framed as an 'Analytics SDK') replicates the same dropper primitives — base64 chunk assembly, fs.chmodSync to 0755 via string-concatenated method name, and detached cp.spawn('/bin/sh', ['-c', filePath + ' &']) — providing a redundant execution path. Endpoint hostnames and fallback domains are assembled by joining fragmented substrings to evade plain-string review.