The npm package cobrowsing-redis-module version 35.4.7 contains malicious code that acts as a dropper. It downloads and executes payloads from multiple command-and-control (C2) endpoints using HTTPS or a DNS-TXT covert channel without verifying the payload integrity. The package masquerades as a Redis wrapper but performs unrelated malicious activities, including writing disguised executables to temporary directories and executing them.