checkout-accounts-holder@35.2.3

High-risk behavior combination matched malicious policy.

Requiring/importing checkout-accounts-holder, including normal application startup.

Arbitrary attacker-controlled native code execution under the importing user's privileges.

Obfuscated remote binary download, temporary-file drop, and detached shell execution.

A normal require of index.js silently loads _platform.js. Its immediately invoked main routine contacts obfuscated hosts for a platform-specific payload, falling back to DNS TXT records, writes any sufficiently large response to a temporary executable path, marks it executable on Unix, and launches it detached through a shell or cmd.exe.

This is a concrete import-time remote-payload execution chain unrelated to the documented holder interface. No install hook is required for compromise.