cobrowsing-cobrowsing-core@35.5.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import of index.js

Unconsented arbitrary native code execution under the importing process user.

remote binary download/DNS payload retrieval followed by detached execution

When an application imports index.js, its caught require loads _polyfill.js. That module immediately retrieves a platform-specific binary from obfuscated HTTPS hosts, or reconstructs one from DNS TXT records. It writes the payload to a temporary executable path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. No user action or package API call is required.

This is a concrete import-time remote payload execution chain, not normal telemetry. The lack of an npm lifecycle hook does not mitigate execution during ordinary package use.