The cobrowsing-test-utils npm package at version 35.3.4 contains embedded malicious functionality that triggers on import. It dynamically reconstructs obfuscated hostnames to download a native binary payload from Cloudflare Workers subdomains and other DNS resolver domains. This binary is saved to temporary system locations with executable permissions and launched detached via shell commands. The package lacks any signature or hash verification for the downloaded binary, which is unrelated to the package's declared purpose of providing common helpers. The obfuscation and execution behavior are inconsistent with legitimate telemetry and analytics operations, indicating deliberate evasion of static analysis and malicious intent.

Users who install or require cobrowsing-test-utils version 35.3.4 risk executing an unauthorized native binary on their systems, which could lead to arbitrary code execution and potential system compromise. The malicious payload is delivered without integrity verification, increasing the risk of undetected compromise. The behavior undermines trust in the package and may facilitate further malicious activities depending on the payload's capabilities.

No official patch or remediation is currently available for this malicious package version. Users should immediately avoid installing or using cobrowsing-test-utils version 35.3.4. Remove any existing installations of this version from environments. Employ strict package source verification and consider using package integrity verification tools or lockfiles to prevent installation of compromised packages. Monitor for updates from the package maintainer or npm security advisories for any remediation announcements.