MAL-2026-12657 Malicious code in cobrowsing-redis-module (npm)

index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split string arrays (e.g. ["oob-worker.cf99-9b3.workers",".d","ev"].join("")) pointing at oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, downloads bytes via https.get, writes them to /var/tmp or %TEMP% under disguised names (dotnet_diag<hex>.exe on Windows,.cache<hex> on POSIX), chmods 0755, and spawns the file detached via /bin/sh -c or cmd.exe. When HTTPS fails, a DNS-TXT covert channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reassembles the payload from base64 TXT chunks (c.<domain> for chunk count, <i>.<domain> for each chunk) via Buffer.from(…,'base64'). No hash or signature verification is performed. A.analytics_state stamp file and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var gates are used as cover-story framing; the destinations and behavior are unrelated to any Redis or cobrowsing functionality. The package name and README present it as an internal Redis wrapper while the sibling _loader.js contains only the dropper.