checkout-desktop-pay-button@35.5.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary attacker-controlled native code runs with the importing process's user privileges.

remote payload download, temporary binary drop, and detached execution

At module import, index.js suppresses errors while loading _bootstrap.js. The bootstrapper selects a platform-specific path, downloads a payload from obfuscated worker hosts or reconstructs one through DNS TXT records, writes it to a temporary location, changes Unix permissions, and starts it detached through a shell or cmd.exe. The visible SDK has no functional need for this native remote-code loader.

This is a concrete import-time remote-code-execution chain concealed behind an unrelated SDK facade. Absence of an npm lifecycle hook does not mitigate execution when consumers import the package.