cobrowsing-utils@35.7.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node process that requires/imports cobrowsing-utils.

Arbitrary attacker-controlled native code executes with the importing process's permissions.

import-time remote binary download and execution

The normal package entrypoint wraps require('./_helpers') in a silent catch. That helper executes at import time, selects a platform payload URL, rotates external hosts, and falls back to DNS TXT reconstruction. A payload over 1000 bytes is dropped into temporary storage, marked executable on Unix, then launched through a detached shell or cmd.exe process.

This is a concrete import-time staged payload downloader and execution chain unrelated to the advertised shared-utilities package. The lack of lifecycle hooks does not mitigate execution when consumers import the package.