checkout-accounts-logic@35.9.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any application requiring checkout-accounts-logic

Arbitrary native code execution as the consuming application's user.

import-time remote binary download, drop, chmod, and detached execution

The public entrypoint silently requires _adapter.js. At import time it fetches a large binary from hard-coded obfuscated Workers hosts, falling back to DNS TXT payload reconstruction; it stores the data in a temporary executable path and launches it detached through cmd.exe or /bin/sh. The large telemetry module contains a parallel native-profiler loader with the same behavior, reinforcing that this is intentional payload execution rather than logging middleware.

The declared package is a logging formatter, but its normal import path executes an unverified remote native payload without user action or consent. This is concrete arbitrary-code execution behavior.