checkout-test-utils@35.1.3

High-risk behavior combination matched malicious policy.

Any runtime require/import of checkout-test-utils

Arbitrary native code execution under the importing process user.

remote binary download, DNS fallback, temp-file execution

index.js silently requires _support.js during normal package import. That module retrieves a platform-specific binary from rotating obfuscated workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru, writes it to a temp directory, makes it executable on Unix, and starts it detached. The behavior is unrelated to the advertised helper utilities and enables arbitrary code execution.

The package has no install hook, but ordinary import reaches an undeclared remote payload downloader and detached executor. This is concrete malicious runtime behavior, not telemetry.