checkout-mobile-legal@35.8.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of checkout-mobile-legal

Arbitrary native code execution as the user running the Node process.

download, write, chmod, and detached execution of an unverified remote payload

A normal require of index.js loads _init.js. Unless opt-out environment variables are set, it downloads a platform-specific payload from obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it to a temp path, makes it executable on Unix, and starts it detached through a shell or cmd.exe. The payload is neither authenticated nor constrained to package functionality.

This is concrete, unconsented remote native payload execution on import, unrelated to the advertised minimal mobile SDK. The absence of an npm lifecycle hook does not mitigate the reachable import-time execution path.