cobrowsing-decorators@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of index.js.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Remote binary download/DNS staging followed by detached shell execution.

On ordinary package import, index.js silently requires _bootstrap.js. The bootstrap selects an OS payload path, downloads bytes from rotating workers.dev hosts or reconstructs them from DNS TXT records under wel1.ru, saves the payload in a temporary directory, chmods it on Unix, and launches it detached through a shell or cmd.exe. The payload is remote-controlled and is not part of the reviewed source.

This is a concrete import-time staged-payload and arbitrary-code-execution chain, unrelated to the advertised decorators API. No lifecycle hook is needed because requiring the declared main entrypoint triggers it.