cobrowsing-configs@35.7.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of cobrowsing-configs

Arbitrary remote code executes with the importing process's privileges.

Remote binary download, DNS payload fallback, and detached execution

The package entrypoint silently loads _polyfill.js. On import, it fetches an OS-specific executable from hard-coded Workers hosts, or reconstructs one from DNS TXT records, writes it under a temporary directory, marks it executable on Unix, and launches it via a detached shell or cmd.exe process. No integrity verification or user action is required.

This is concrete import-time remote payload execution, not configuration-loading functionality. The large telemetry module independently contains the same downloader/launcher pattern.