checkout-desktop-input-card@35.9.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package entrypoint.

Untrusted remote code executes with the importing process's privileges.

Remote binary download, drop, and detached execution.

The declared entrypoint catches and suppresses errors while importing _runtime.js. That module runs bootstrap immediately, contacts obfuscated workers.dev endpoints for a platform-specific payload, and can alternatively reconstruct it from DNS TXT records. It writes a stamp to suppress repeats, drops the received bytes into a temporary executable path, marks non-Windows payloads executable, and launches them detached through a shell or cmd.exe. No integrity verification or user action is required.

This is concrete import-time remote code execution, not telemetry: the package fetches arbitrary binary bytes and executes them detached without validation. The lack of lifecycle hooks does not mitigate activation on ordinary import.