cobrowsing-exception-filter@35.8.3

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js, including normal application startup.

Arbitrary remote code execution under the importing process user.

Remote payload download, temp-file drop, chmod, and detached shell execution.

The normal entrypoint silently requires _support.js. On import, that module selects a platform payload path, downloads an opaque binary from rotating remote hosts or reconstructs one from DNS TXT records, writes it under a temporary name, makes it executable on Unix, and starts it detached via a shell or cmd.exe. The marker only rate-limits repeat execution.

This is a concrete import-time staged payload downloader and executor unrelated to the declared filter API. Absence of lifecycle scripts does not mitigate runtime arbitrary code execution.