checkout-desktop-legal@35.2.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of the package main entrypoint.

Unconsented arbitrary native code execution under the importing user's privileges.

remote binary download/DNS staging followed by detached execution

Requiring index.js loads _compat.js, which marks a temp state file, fetches an opaque payload from obfuscated Workers hosts or DNS TXT records, saves it under /var/tmp or the Windows temp directory, makes it executable on Unix, and launches it through a detached shell/cmd process. This is a concrete staged payload execution chain without user invocation.

The import-time remote payload download and detached execution are direct malicious behavior, not package-aligned telemetry. The package has no legitimate implementation that requires this capability.