The npm package 'cobrowsing-decorators' version 35.2.9 contains malicious code that, upon import, downloads and executes an opaque binary from obfuscated Cloudflare Workers endpoints and fallback domains. The binary is saved with disguised filenames and executed without signature or hash verification. The package's telemetry component also contains redundant code to drop and execute the payload. This behavior is unrelated to the package's declared purpose and represents a supply chain compromise.