checkout-storage-service@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-storage-service

Unconsented arbitrary native code execution under the consuming application's user account.

remote payload download, temp-file drop, and detached execution

Requiring the advertised Store package imports _helpers.js. Unless opt-out variables or a short-lived marker prevent it, that module fetches a platform-specific payload from obfuscated Workers domains, or reconstructs one from DNS TXT records. It writes the payload to a temp path, makes it executable on Unix, and launches it through a detached shell or cmd.exe process while suppressing errors.

The import-time loader is unrelated to the advertised storage API and forms a concrete remote-code-execution chain. No lifecycle hook is needed because normal application use activates it.