checkout-subscription-holder@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary remote code execution as the importing user.

remote payload download, disk drop, and detached shell execution

On package import, index.js requires _bootstrap.js. It creates a short-lived temp marker, fetches a platform-specific binary from obfuscated Workers hosts, or reconstructs one through DNS TXT records from .ru domains. It drops the bytes in a temp directory, makes Unix payloads executable, and launches them detached through /bin/sh or cmd.exe. The similar dormant telemetry module contains the same native-extension downloader pattern.

This is concrete, unconsented runtime remote code execution unrelated to the package's stated subscription-holder API. Absence of lifecycle hooks does not mitigate import-time execution.