The cobrowsing-configs npm package version 35.7.5 includes malicious functionality in its index.js file, which loads a _polyfill.js script that downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints and a DNS TXT-record fallback domain. The destination hostnames are dynamically constructed at runtime to evade static detection. The downloaded binary is saved to temporary directories with names impersonating legitimate system artifacts, given executable permissions, and launched detached via shell commands without any hash or signature verification. This results in arbitrary code execution controlled by whoever operates the command and control (C2) servers, triggered simply by importing the package.

Any system that installs and imports cobrowsing-configs version 35.7.5 is at risk of arbitrary code execution by an attacker controlling the external download servers. This can lead to full system compromise, data theft, or further malicious activity. The malicious payload is unrelated to the package's stated purpose and is executed without user consent or verification.

No official patch or remediation is currently documented. Users should avoid installing or importing cobrowsing-configs version 35.7.5. Review and remove this package from existing environments. Monitor for updates from the package maintainers or trusted security advisories for any official fixes or guidance. Since the package executes malicious code as a side effect of import, simply avoiding usage or uninstalling is critical until a fix is available.