cobrowsing-logger@35.7.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of cobrowsing-logger.

Arbitrary native code execution under the importing process user.

Import-time remote binary download, drop, permission change, and detached execution.

The public entrypoint catches and suppresses errors while importing _adapter.js. That module immediately fetches a platform-specific executable from obfuscated Cloudflare Worker hosts, with DNS TXT reconstruction as fallback. It drops the response to a temporary file, makes it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote payload execution chain unrelated to the stated logging function.

The import-time code establishes a complete download-to-execution chain with obfuscated endpoints and no user invocation or integrity verification. Absence of npm lifecycle hooks does not mitigate runtime arbitrary code execution.