checkout-input-card-logic@35.8.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-input-card-logic.

Arbitrary code execution as the importing process user.

Import-time remote payload download and detached native execution.

Requiring the package loads _vendor.js under a swallowed error handler. That module contacts rotated workers.dev hosts for a platform-specific binary and, if unavailable, reconstructs bytes from DNS TXT records. It writes the payload to a temporary path, sets execute permissions on non-Windows systems, and launches it detached through /bin/sh or cmd.exe. The behavior is unrelated to the documented log formatter and has no integrity verification.

The package contains a concrete, import-time arbitrary native payload execution chain. Its benign exported logger does not mitigate the hidden loader.