checkout-desktop-accounts@35.7.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js, unless opt-out environment variables are set.

Arbitrary attacker-controlled native code runs as the importing process user.

remote binary download, drop, chmod, and detached execution

Requiring index.js silently loads _loader.js. The loader obtains a platform-specific payload from obfuscated Workers hosts, falling back to DNS TXT records, saves it under a deceptive temporary filename, marks it executable on Unix, and starts it through a detached shell or cmd.exe process. This is concrete remote code execution without user consent.

The hidden import-time loader provides a complete remote payload execution chain; the absent npm lifecycle hook does not mitigate runtime compromise.