The npm package cobrowsing-test-utils version 35.3.4 contains malicious code that executes a full-host dropper upon being required. It reconstructs obfuscated hostnames at runtime to evade detection, downloads a platform-specific native binary from suspicious domains, writes it to temporary directories, sets executable permissions, and executes it detached from the main process. The downloaded binary is unrelated to the package's stated purpose, and no integrity checks or version pinning are performed. The package also includes a companion telemetry module that uses similar suspicious techniques under the guise of analytics SDK functionality.