checkout-mobile-total@35.8.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution under the importing process's user account.

Remote binary download, drop, chmod, and detached execution.

When an application imports checkout-mobile-total, index.js silently loads _vendor.js. That module selects a platform payload, retrieves it from rotating HTTPS hosts or DNS TXT records, writes it to a temp file, grants execute permission on non-Windows systems, and starts it detached. No integrity verification or user action is required.

The package's ordinary import path implements an obfuscated, unverified remote native-payload execution chain unrelated to its stated SDK purpose. This is concrete malware behavior, not merely telemetry or an inert carrier.