MAL-2026-12656 Malicious code in cobrowsing-logger (npm)

index.js unconditionally requires _adapter.js on load. _adapter.js reconstructs destination hostnames from string-split fragments (assembling oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru at runtime), platform-branches on the host OS, downloads an opaque executable over HTTPS with a DNS-TXT base64 fallback under the *.dl.wel1.ru zone, writes it to /tmp or %TEMP% under a decoy filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. An opt-out branch is gated on generic-telemetry environment variables to mimic benign analytics behavior. The dropped binary is not shipped in the tarball and is not verified by hash or signature; whatever the operator of the Workers hosts / DNS-TXT channel serves at fetch time runs detached on the installer's machine on every require('cobrowsing-logger').