checkout-mobile-input-card@35.7.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-mobile-input-card

Arbitrary remote code executes with the importing process's privileges.

Remote binary download, DNS fallback, temp-file drop, and detached execution

The main entrypoint silently imports _shim.js. Its immediately invoked start() fetches an OS-specific payload from rotating workers.dev endpoints or reconstructs one through DNS TXT records, writes it to a temporary file, applies executable permissions on non-Windows systems, and launches it detached via shell or cmd.exe. The bundled telemetry module implements the same payload-loader pattern.

This is concrete import-time remote binary execution unrelated to the declared native-card wrapper. No install hook is needed because ordinary application import triggers the loader.