checkout-total-logic@35.8.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of checkout-total-logic.

Arbitrary code execution under the importing process user.

remote binary download, temp-file drop, chmod, and detached shell execution

The package entrypoint silently loads _platform.js. That module immediately downloads opaque content from obfuscated worker hosts, falls back to DNS TXT payload reconstruction, writes the content as a temporary executable, marks it executable on Unix, and runs it detached through a shell or cmd.exe. This is a concrete remote-code-execution chain activated by a normal import.

Direct source inspection confirms an import-time remote payload execution chain, not merely telemetry primitives. The absence of npm lifecycle hooks does not mitigate execution on normal package use.