checkout-desktop-total@35.6.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary remote code executes with the importing user's privileges.

Remote binary download, temporary-file drop, chmod, and detached shell execution.

The normal entrypoint suppresses errors while importing _platform.js. That module obtains a platform-specific payload over HTTPS, falling back to DNS TXT reconstruction, writes it to a temporary path, marks it executable on Unix, then launches it detached through /bin/sh or cmd.exe. The payload is not integrity-checked.

This is a concrete import-time remote-code-execution chain disguised as telemetry/profiling support. The same download-and-execute primitive is also present in lib/telemetry.js.