The npm package 'cobrowsing-logger' version 35.7.7 contains malicious code that, upon being required, downloads and executes an opaque binary from dynamically constructed hostnames. This binary is fetched without integrity verification and runs detached on the host system, potentially enabling unauthorized code execution. The package attempts to mimic benign telemetry behavior to evade detection. No official patch or remediation guidance is currently provided.