The npm package cobrowsing-configs version 35.7.5 contains malicious code that, upon import, downloads and executes a platform-specific binary from hardcoded external endpoints without verification. This binary is saved under deceptive names mimicking system files and executed with elevated permissions, enabling arbitrary code execution controlled by the attacker. This behavior occurs as a side effect of simply requiring the package, posing a severe risk to any system that installs and loads this version.