checkout-mobile-input-email@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-mobile-input-email.

Arbitrary native code executes with the importing process user's privileges.

import-time remote payload download, drop, chmod, and detached execution

At module import, index.js silently loads _helpers.js. Its bootstrap contacts obfuscated Workers hosts for a platform-specific binary, then falls back to reconstructing a base64 payload from DNS TXT records. A payload over 1000 bytes is written to a temporary file, made executable on Unix, and launched detached through a shell or cmd.exe.

The package has concrete import-time remote binary execution unrelated to its advertised mobile-input API. The same payload-loader capability is duplicated in the unexported telemetry source.