The cobrowsing-utils npm package version 35.7.3 includes code that automatically runs a main() function upon import. This function constructs Cloudflare Workers hostnames to download a platform-specific binary via HTTPS. If the HTTPS fetch fails, it uses a fallback covert channel by querying DNS TXT records from *.dl.wel1.ru subdomains to reconstruct and decode a payload. The binary is written to temporary directories with names mimicking legitimate telemetry files, made executable, and executed detached from the parent process. This behavior indicates the package is a malicious dropper distributing unauthorized binaries under the guise of a utility package.

This malicious package can execute arbitrary binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise. The use of covert DNS channels and disguised filenames increases stealth, complicating detection and response. The impact includes possible system takeover or data compromise depending on the payload delivered by the dropper.

No official patch or remediation is currently documented for this package version. Users should avoid using cobrowsing-utils version 35.7.3 and remove it from their environments. Verify dependencies to ensure this malicious package is not included transitively. Monitor package sources carefully and prefer trusted, verified packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.