checkout-input-email-logic@35.8.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-input-email-logic.

Arbitrary remote code execution under the importing process user.

import-time remote payload download and detached execution

The public entrypoint suppresses errors while importing _bridge.js. On import, the bridge checks a temporary stamp, downloads a platform-specific opaque binary from obfuscated HTTPS hosts or assembles one from DNS TXT records, stores it in a temporary directory, marks it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain.

The package's advertised logging behavior does not justify an import-time downloader and detached binary launcher. No lifecycle script is needed because the attack is activated by normal package import.