cobrowsing-k8s-module@35.6.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Unconsented remote code execution in the importing user's environment.

remote binary download, disk drop, chmod, and detached shell execution

Requiring index.js silently loads _bridge.js. The bridge fetches a platform-specific binary from rotating remote hosts, or reconstructs one from DNS TXT records, saves it in a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is an import-time staged payload execution chain with no user-facing feature requiring it.

The entrypoint reaches concrete remote payload download and execution code at import time. Lack of an install hook does not mitigate this runtime remote-code-execution behavior.