# MAL-2026-12658: Malicious code in cobrowsing-test-utils (npm)


- **Type:** Malicious package
- **Package:** `cobrowsing-test-utils` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12658?

MAL-2026-12658 is a malicious package in cobrowsing-test-utils, published on 5 Aug 2026. 

### Official description

cobrowsing-test-utils@35.3.4 executes a full-host dropper on require(). index.js loads _support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays (Cloudflare Workers subdomains under workers.dev and DNS resolver domains under dl.wel1.ru), downloads a platform-specific native binary over HTTPS with a DNS TXT-record fallback, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. There is no version pinning, no signature or hash verification, and the fetched binary is unrelated to the package's stated 'common helpers' purpose. Cover-story identifiers such as 'analytics_state' and 'DISABLE_TELEMETRY' do not correspond to the observed behavior. A companion module lib/telemetry.js ships the same fetch/base64-decode/chmod-0755/spawn('/bin/sh','-c', path+' &') primitives under Sentry-style analytics-SDK boilerplate. Hostname obfuscation via runtime string joining (e.g., ['sdk.d','l.wel1','.r','u'].join('') and ['oob-worker.cf','...','workers','.de','v'].join('')) is a deliberate evasion of static analysis and is inconsistent with legitimate telemetry.

## What should I do about MAL-2026-12658?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12658 is a malicious package: cobrowsing-test-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12658/ (Markdown: https://insights.sbomify.com/MAL-2026-12658/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12658

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12658/
Summaries are generated and may contain mistakes; the official description above is the record.