The devplatform-spa-plugin-cobrowsing npm package version 35.4.4 includes malicious functionality triggered on require(). It loads a runtime script that selects a platform-specific endpoint and downloads a binary payload over HTTPS from obfuscated Cloudflare Workers hostnames constructed at runtime. A DNS TXT-record fallback channel provides base64-encoded payload chunks. The binary is saved to temporary filesystem locations with executable permissions and executed detached from the main process. The payload execution bypasses integrity verification, and the destinations are unrelated to the package's legitimate purpose, indicating deliberate malicious behavior.

This malicious package can execute arbitrary code on the host system with the privileges of the running process. The downloaded payload is opaque and executed without integrity checks, potentially enabling remote code execution, persistence, or other malicious activities. The obfuscation and dynamic payload retrieval increase the difficulty of detection and analysis.

No official patch or remediation is currently documented. Users should avoid using devplatform-spa-plugin-cobrowsing version 35.4.4 and remove it from their environments. Monitor for and block network connections to suspicious Cloudflare Workers hostnames constructed similarly to those described. Verify package integrity before installation and prefer trusted sources. Patch status is not yet confirmed — check the vendor advisory or official sources for updates.