The cobrowsing-redis-module npm package version 35.4.7 includes a malicious loader (_loader.js) that dynamically assembles C2 hostnames and downloads payloads via HTTPS. If HTTPS download fails, it uses a DNS-TXT covert channel to reconstruct the payload from base64-encoded chunks. The payload is saved to temporary directories with disguised filenames and executed without integrity checks. Environmental variables and stamp files are used as a cover story, but the actual behavior is unrelated to Redis or cobrowsing functionality. This is a malicious package designed to drop and execute arbitrary code on the host system.

This malicious package can lead to arbitrary code execution on systems that install version 35.4.7 of cobrowsing-redis-module. The dropped payloads are fetched from attacker-controlled servers without any integrity verification, increasing the risk of compromise. Execution of these payloads can result in full system compromise depending on the payload delivered.

No official patch or remediation is currently documented. Users should immediately remove version 35.4.7 of the cobrowsing-redis-module from their environments and avoid installing this package. Verify the integrity and provenance of npm packages before installation. Monitor for any unexpected executables in temporary directories and restrict execution permissions where possible. Check vendor advisories or npm security advisories for updates or official fixes.