The npm package cobrowsing-utils version 35.7.3 contains malicious code that executes a binary dropper as a side effect of importing the package. This dropper fetches a platform-specific binary from Cloudflare Workers hostnames or, if that fails, retrieves it via a covert DNS-TXT channel from *.dl.wel1.ru subdomains. The binary is saved under disguised filenames in temporary directories, given executable permissions, and launched detached from the main process. The package falsely advertises itself as shared utilities, but the fetched binary is unrelated to its stated purpose.