The cobrowsing-cobrowsing-core npm package at version 35.5.8 contains malicious code that functions as a binary dropper. When the package is imported, it dynamically selects a platform-specific payload for Linux (x64 and ARM64), macOS (darwin), or Windows (win32) and fetches attacker-controlled binaries from Cloudflare Workers domains under oob-worker.cf1xx-*.workers.dev. These binaries are saved to temporary directories with disguised filenames, permissions are set to executable, and the binaries are spawned detached via shell commands. No integrity checks such as signature or hash verification are performed. Additionally, a DNS TXT record-based covert channel is implemented as a fallback delivery method, where base64-encoded payload fragments are retrieved from specific domains and executed. The package uses runtime string assembly and obfuscation techniques to evade detection. A secondary dropper implementation is present in lib/telemetry.js, mimicking an analytics SDK but containing the same malicious primitives. Any user who installs and requires this package will execute attacker-controlled code on their host.

This malicious package enables arbitrary code execution on the host system of any user who installs and imports it. The attacker can deliver and execute platform-specific payloads without any verification, potentially leading to full system compromise. The use of obfuscation and covert DNS channels complicates detection and analysis. This poses a significant risk to the confidentiality, integrity, and availability of affected systems.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or using cobrowsing-cobrowsing-core version 35.5.8. Remove the package from any affected systems immediately if installed. Use trusted sources and verify package integrity before installation. Monitor package dependencies for suspicious or unexpected additions. Since this is a malicious package rather than a vulnerability with a vendor fix, remediation relies on removal and prevention of installation.