checkout-desktop-bnpl@35.5.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package main entrypoint.

Arbitrary code execution under the importing process user.

Remote payload download, temporary-file drop, and detached execution.

Requiring index.js silently requires _polyfill.js, which immediately calls start(). It fetches a platform-specific payload from obfuscated Workers hosts, falling back to DNS TXT-delivered base64 data. Payloads over 1000 bytes are saved under /var/tmp or the Windows temp directory, made executable on Unix, and launched detached through /bin/sh or cmd.exe. There is no integrity verification or user action.

This is a concrete import-time remote-code-execution chain unrelated to the stated checkout component functionality. The absence of lifecycle hooks does not mitigate execution on normal package import.