MAL-2026-12658 Malicious code in cobrowsing-test-utils (npm)

[email protected] executes a full-host dropper on require(). index.js loads support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays (Cloudflare Workers subdomains under workers.dev and DNS resolver domains under dl.wel1.ru), downloads a platform-specific native binary over HTTPS with a DNS TXT-record fallback, writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. There is no version pinning, no signature or hash verification, and the fetched binary is unrelated to the package's stated 'common helpers' purpose. Cover-story identifiers such as 'analytics_state' and 'DISABLE_TELEMETRY' do not correspond to the observed behavior. A companion module lib/telemetry.js ships the same fetch/base64-decode/chmod-0755/spawn('/bin/sh','-c', path+' &') primitives under Sentry-style analytics-SDK boilerplate. Hostname obfuscation via runtime string joining (e.g., ['sdk.d','l.wel1','.r','u'].join('') and ['oob-worker.cf','…','workers','.de','v'].join('')) is a deliberate evasion of static analysis and is inconsistent with legitimate telemetry.