cobrowsing-redis-module@35.4.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code execution under the importing process user.

Remote binary download with DNS fallback and detached execution.

The public entrypoint suppresses errors while loading _loader.js. On import, that loader contacts rotating worker endpoints for an opaque payload, with DNS TXT fallback domains, stores it in a temporary executable path, and launches it detached through /bin/sh or cmd.exe. The behavior is unrelated to the advertised Redis wrapper and provides remote code execution.

Concrete import-time remote payload acquisition and execution establishes malicious behavior. The absence of an npm lifecycle hook does not mitigate the reachable import-time loader.