Malicious code in devplatform-spa-plugin-cobrowsing (npm)

__

Source: amazon-inspector (96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e)

On require() of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscated Cloudflare Workers hosts (hostnames assembled at runtime via array-join, e.g. 'oob-worker.cf-.workers.dev'), with a DNS TXT-record fallback channel under 'c.' / 'N.' that returns base64-encoded chunks decoded into the payload. The downloaded bytes are written to /tmp/.cache (chmod 0755) on Unix or %TEMP%/dotnet_diag_.exe on Windows, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}).unref() or a cmd equivalent. Destinations are unrelated to the package's stated cobrowsing purpose, hostnames are obfuscated to defeat static analysis, and the payload is executed with no integrity check.