{"answers":{"affected":"1 open source package ship an affected version, including cobrowsing-test-utils.","exploited":"There is no known exploitation of MAL-2026-12658 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12658 is a malicious package in cobrowsing-test-utils, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12658 is a malicious package: cobrowsing-test-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12658/ (Markdown: https://insights.sbomify.com/MAL-2026-12658/index.md)","id":"MAL-2026-12658","markdown":"https://insights.sbomify.com/MAL-2026-12658/index.md","name":"MAL-2026-12658","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"cobrowsing-test-utils@35.3.4 executes a full-host dropper on require(). index.js loads _support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays (Cloudflare Workers subdomains under workers.dev and DNS resolver domains under dl.wel1.ru), downloads a platform-specific native binary over HTTPS with a DNS TXT-record fallback, writes it to /var/tmp/.cache_\u003chex\u003e on Unix or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on Windows, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. There is no version pinning, no signature or hash verification, and the fetched binary is unrelated to the package's stated 'common helpers' purpose. Cover-story identifiers such as 'analytics_state' and 'DISABLE_TELEMETRY' do not correspond to the observed behavior. A companion module lib/telemetry.js ships the same fetch/base64-decode/chmod-0755/spawn('/bin/sh','-c', path+' \u0026') primitives under Sentry-style analytics-SDK boilerplate. Hostname obfuscation via runtime string joining (e.g., ['sdk.d','l.wel1','.r','u'].join('') and ['oob-worker.cf','...','workers','.de','v'].join('')) is a deliberate evasion of static analysis and is inconsistent with legitimate telemetry.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in cobrowsing-test-utils (npm)","id":"MAL-2026-12658","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"cobrowsing-test-utils","purl":"pkg:npm/cobrowsing-test-utils","source":"MAL-2026-12658"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12658/"}