checkout-parameters@35.8.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary native code can execute under the importing user's account.

remote payload download, temporary-file drop, and detached execution

Requiring index.js loads _vendor.js, which immediately calls start(). It contacts obfuscated hard-coded worker hosts for a platform-specific binary, with DNS TXT reconstruction as fallback. The downloaded bytes are written to a temporary executable filename, made executable on non-Windows systems, and launched detached via shell or cmd.exe. This is unconsented remote code execution with no implemented payload integrity validation.

The package's advertised checkout-parameter API does not require a silent native downloader. Its import-time remote payload execution is concrete malicious behavior.