checkout-pay-widget-logic@35.3.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package entrypoint.

Unconsented arbitrary native code execution on the importing host.

Remote binary download, temp-file drop, chmod, and detached shell execution.

Requiring index.js invokes _vendor.js automatically. That module selects a platform-specific endpoint, downloads a binary from obfuscated workers.dev hosts or DNS TXT records, saves it under a temporary filename, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. A temporary timestamp file only throttles repeats; it does not require user consent.

The import-time downloader and detached execution form a concrete remote-code-execution chain, independent of npm lifecycle hooks. The larger telemetry file contains a similarly capable configurable loader but is not needed to establish the attack.