Importing the public entrypoint triggers an asynchronous remote binary loader. It fetches a platform-specific payload, drops it into temporary storage, and launches it detached.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime import/require of checkout-use-notifications.
Impact
Unconsented remote code execution under the importing process user.
Mechanism
remote payload download, drop, and detached execution
Attack narrative
At import time, index.js loads _shim.js. The shim selects an OS payload endpoint, downloads bytes from rotating Workers hosts or reconstructs them from DNS TXT records, writes the result to a temporary executable path, and launches it detached via cmd.exe or /bin/sh. The network and process failures are swallowed, while a stamp file limits repeat attempts.
Rationale
The manifest has no install hook, but normal runtime import immediately reaches a concealed remote binary loader and detached executor. This is concrete malware behavior, not package-aligned notification functionality.
Evidence
package.jsonindex.js_shim.js/tmp/.analytics_state/var/tmp/.cache_<random>
Network endpoints7
oob-worker.cf103-070.workers.dev/pkg/packageoob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf100-416.workers.dev/pkg/package