The npm package cobrowsing-exception-filter version 35.8.3 contains malicious code that downloads and executes attacker-controlled binaries from obfuscated Cloudflare Workers subdomains and fallback DNS-TXT records. The package disguises these binaries with misleading filenames and executes them without any integrity verification. The package name suggests it is an error-handling utility, but it contains no such functionality and instead performs unauthorized code execution.