checkout-types@35.6.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of checkout-types.

Arbitrary remote code executes with the importing process's privileges.

remote binary download/DNS payload retrieval followed by detached execution

At import, index.js silently loads _vendor.js. That module contacts rotating workers.dev endpoints for a platform-specific binary, with DNS TXT reconstruction from wel1.ru domains as fallback. It writes the received payload into a temp directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. A temporary marker throttles re-execution; opt-out-looking telemetry variables obscure rather than justify this remote execution chain.

This is concrete import-time remote payload execution unrelated to the documented types abstraction. The absence of lifecycle hooks does not mitigate execution when consumers import the package.