checkout-checkout-test-block-aff@35.9.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the main entrypoint.

Arbitrary attacker-controlled native code runs as the importing user's process.

remote binary download, temporary-file drop, and detached execution

When the documented module is imported, index.js silently requires _loader.js. The loader contacts rotated HTTPS hosts or DNS TXT records for a platform-specific payload, writes it to a temporary path, marks Unix payloads executable, and starts it detached through a shell or cmd.exe. This is concealed behind a mock-builder package with no feature requiring native payload delivery.

Source directly establishes import-time download-and-execute behavior with attacker-controlled remote payload bytes. The lack of lifecycle scripts does not mitigate the reachable import-time execution chain.