checkout-desktop-promocode@35.4.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary code execution as the consuming Node process user.

Remote payload download, drop, chmod, and detached execution.

The public entrypoint silently requires _vendor.js. On import, it selects a platform payload path, attempts downloads from obfuscated worker hosts, then falls back to DNS TXT records. A successful payload is written under a misleading temporary name, marked executable on Unix, and launched detached with /bin/sh or cmd.exe. The stamp file and swallowed errors reduce visibility and limit repeat attempts.

This is a concrete, automatically reachable remote-code-execution chain unrelated to the stated promocode SDK. The unused telemetry module contains a parallel payload-loader implementation, reinforcing intent.