cobrowsing-test-utils@35.3.4

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js

Arbitrary native code execution under the importing process's user.

remote binary download, disk drop, and detached execution

index.js suppresses errors while automatically loading _support.js. That module fingerprints the platform, downloads a binary from obfuscated rotating hosts or DNS TXT records, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented remote-payload execution chain.

The import-reachable downloader and detached binary launcher are concrete malicious behavior, not telemetry. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.