checkout-desktop-pay-widget@35.6.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js

Arbitrary remote code execution under the importing user's account.

remote binary download or DNS payload reconstruction followed by detached execution

On ordinary package import, index.js silently requires _shim.js. The shim contacts obfuscated workers.dev mirrors for a platform-specific binary, with DNS TXT reconstruction from wel1.ru as fallback. It writes the opaque payload into temporary storage, marks it executable on Unix, and starts it through a detached shell or cmd.exe process. The surrounding widget exports do not justify this behavior.

This is an import-time staged remote payload loader and executor, not telemetry. Its remote code is unauthenticated and runs without user consent.