The 'checkout-accounts-holder' npm package (version 35.2.3) includes malicious functionality where requiring the package triggers execution of code that downloads a binary payload from dynamically assembled hostnames (e.g., 'oob-worker.cf100-416.workers.dev' with DNS TXT fallback 'sdk.dl.wel1.ru'). The payload is written to temporary directories with misleading filenames, permissions are set to executable (chmod 0o755), and the binary is spawned detached via shell commands. The package presents itself as telemetry ('analytics_state') but executes attacker-controlled code with the privileges of the user installing the package. Additionally, a second dropper with similar behavior is present but unreferenced in the published tarball. The use of string splitting to assemble hostnames and base64 chunking of payloads is intended to evade detection by static scanners.

This malicious package enables arbitrary code execution on the host system with the privileges of the user installing the package. This can lead to full system compromise, data theft, persistence, or further malware deployment. Because the payload is downloaded and executed dynamically, it can be updated or changed by the attacker post-installation. The presence of a second unreferenced dropper indicates multiple attack vectors within the package.

No official patch or remediation is currently documented for this package version. Users should immediately remove 'checkout-accounts-holder' version 35.2.3 from their environments and avoid installing it. Audit systems for any signs of execution of the described payloads or presence of suspicious files in temporary directories. Consider blocking network connections to the indicated hostnames and use trusted package sources. Monitor for updates from the package maintainer or security advisories for any official fixes.