checkout-iframe@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of checkout-iframe.

Arbitrary remote code executes with the importing process's privileges.

remote binary download, drop, chmod, and detached execution

The public entrypoint silently imports _platform.js. On import, it downloads a platform-specific payload from obfuscated workers.dev mirrors or DNS TXT records, drops it in a temporary directory, makes it executable on Unix, and starts it detached via a shell or cmd.exe. This is unrelated to the stated checkout iframe functionality.

This is a concrete import-time remote-code-execution chain, not merely telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.