The 'cobrowsing-logger' npm package (version 35.7.7) includes a malicious module '_adapter.js' that reconstructs destination hostnames at runtime and downloads an opaque executable over HTTPS, with a DNS-TXT base64 fallback mechanism. The executable is saved to temporary directories with decoy filenames, permissioned to be executable, and then spawned detached via shell commands depending on the OS. The dropped binary is not included in the package tarball and lacks any hash or signature verification, meaning the code executed depends entirely on what the remote server serves at fetch time. An opt-out mechanism based on generic telemetry environment variables is present to simulate legitimate analytics behavior. This behavior constitutes a supply chain compromise allowing arbitrary code execution on any system requiring this package.

This malicious package enables arbitrary code execution on the host system of any user who installs and requires 'cobrowsing-logger' version 35.7.7. The executed binary is fetched dynamically and without verification, posing a high risk of persistent compromise, data theft, or further malware deployment. Because the binary runs detached and is not part of the package, it is difficult to detect or analyze. The opt-out branch may reduce suspicion but does not mitigate the underlying risk.

No official patch or remediation is currently documented. Users should immediately cease using 'cobrowsing-logger' version 35.7.7 and audit any systems where it was installed. Consider removing the package and any related dropped binaries from affected systems. Monitor for suspicious processes or network connections to the indicated domains. Check the vendor or npm advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.