The malicious code in cobrowsing-k8s-module version 35.6.2 activates when the package's main entry (_bridge.js) is required. It selects platform-specific endpoints and reconstructs obfuscated remote hostnames at runtime. The code fetches an opaque binary payload over HTTPS, writes it to hidden temporary files with cover-story names, sets executable permissions, and spawns it detached via shell commands. If the HTTPS fetch fails, it falls back to a DNS-TXT covert channel that reads base64-encoded binary chunks from multiple TXT records to bypass HTTP egress filtering. The payload is executed without any hash or signature verification, increasing risk. The malicious activity is disguised as legitimate analytics or telemetry operations.

The malicious package can execute arbitrary binary code on the host system by downloading and running an opaque payload without integrity checks. This can lead to unauthorized code execution, potential system compromise, and evasion of network security controls via fallback to DNS covert channels. The disguise as analytics/telemetry may reduce suspicion and facilitate persistence or further malicious actions.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using cobrowsing-k8s-module version 35.6.2. Remove any installations of this package and replace with trusted alternatives. Monitor for suspicious child process executions and network connections to the indicated domains. Employ network controls to block the identified malicious endpoints and DNS covert channels. Verify package integrity before use and prefer packages from trusted sources.