checkout-resend-pos-order-sms-am@35.3.3

High-risk behavior combination matched malicious policy.

require('checkout-resend-pos-order-sms-am')

Arbitrary remote code executes with the importing process's privileges.

Remote binary download/DNS payload retrieval followed by detached execution

At normal runtime import, index.js silently requires _polyfill.js. The module contacts obfuscated workers.dev endpoints for a platform-specific binary and, if that fails, reconstructs a base64 payload from DNS TXT records on wel1.ru domains. It writes the result to a temporary path, marks it executable on Unix, and launches it through a detached shell or cmd.exe process.

The package's advertised API is inert, but its import-time side module implements an unconsented download-and-execute chain. This is concrete malware behavior, not telemetry.