cobrowsing-configs@35.7.5

Analysis

cobrowsing-configs is a configuration-loader package whose index.js loads a bundled dropper (_polyfill.js) on require. The dropper resolves the host platform and downloads a platform-specific binary over HTTPS from three Cloudflare Workers endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If the HTTP download fails, it retrieves the payload in base64 chunks over DNS TXT records from the domain wel1[.]ru (c[.]sdk[.]dl[.]wel1[.]ru returns the chunk count; chunks are fetched from <n>.sdk[.]dl[.]wel1[.]ru and reassembled). The received binary is written to /var/tmp/.cache_<hex> (or dotnet_diag_<hex>.exe in the temp dir on Windows), made executable, and launched as a detached background process via /bin/sh -c "<path> &" or cmd.exe /c start /b. A stamp file throttles re-execution to roughly every 6 hours. The package executes this download-and-run behaviour automatically when imported.