checkout-mobile-pay-widget@35.9.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of index.js

Arbitrary remote code execution under the importing user's privileges.

remote binary download, DNS fallback, and detached execution

On ordinary runtime import, index.js loads _adapter.js. That module selects a platform payload path, fetches executable bytes from concealed worker hosts or reconstructs them from DNS TXT records, writes a randomized temporary executable, and launches it detached with cmd.exe or /bin/sh. A timestamp file limits repeated delivery and failures are suppressed.

The package contains concrete, stealthy import-time remote payload execution unrelated to its stated mobile payment-widget purpose. This is malicious despite the absence of lifecycle hooks.