The 'cobrowsing-decorators' npm package version 35.2.9 includes malicious functionality in its index.js and telemetry.js files. On require/import, it unconditionally loads a bootstrap script that selects a platform-specific asset path and fetches a binary payload from obfuscated Cloudflare Workers endpoints, with fallback to suspicious domains. The payload is written to disguised temporary filenames, permissions are set to executable (chmod 0755), and it is spawned detached via shell commands. No integrity checks are performed on the payload. The telemetry.js file replicates these dropper behaviors, providing a redundant execution path. The endpoint hostnames and fallback domains are assembled dynamically to evade detection. This malicious behavior is unrelated to the package's stated purpose of providing 'cobrowsing decorators'.

This malicious package can lead to arbitrary code execution on systems that import or require it, potentially allowing attackers to execute unauthorized binaries. The lack of signature or hash verification increases the risk of executing untrusted code. The disguised filenames and obfuscated endpoint assembly hinder detection and analysis. This represents a supply chain attack vector affecting users of the specific package version.

No official patch or remediation is currently documented. Users should avoid using 'cobrowsing-decorators' version 35.2.9 and remove it from their projects. Verify dependencies for integrity and source authenticity before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.