checkout-get-pos-documents-am@35.8.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the main index.js entrypoint.

Arbitrary attacker-controlled native code execution under the importing process user.

import-time remote binary download, drop, chmod, and detached execution

Importing index.js catches and suppresses errors while loading _compat.js. That file immediately runs start(), fetches an opaque binary from rotating Workers hosts or DNS TXT records, saves it under a disguised temporary filename, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. This is an unconsented remote code execution chain.

The downloader/executor is reachable at import time and its payload is fully remote-controlled, with obfuscated endpoints and concealed failure handling. This is concrete malware behavior, not ordinary telemetry.