checkout-mobile-accounts@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-mobile-accounts.

Arbitrary attacker-controlled code executes with the privileges of the importing process.

Import-time remote binary download, drop, chmod, and detached execution.

Loading index.js silently requires _platform.js. That module fetches a platform-specific payload from obfuscated workers.dev mirrors, falling back to DNS TXT records under wel1.ru, writes it to a temporary executable path, chmods it on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain.

The malicious behavior is directly reachable on ordinary package import and executes unauthenticated remote content. No lifecycle hook is needed for the package to compromise an application process.