The 'checkout-base-analytics-data' npm package version 35.9.1 includes a hidden _polyfill.js script that, when the package is required, performs a bootstrap routine to fetch a native binary over HTTPS from obfuscated hostnames constructed at runtime. These hostnames include *.workers.dev and *.wel1.ru subdomains, with DNS-TXT fallback mechanisms. The binary is saved to temporary directories under disguised filenames, permissions are set to executable, and it is executed detached via shell commands. The obfuscation techniques used (string-array concatenation and try/catch to silence import failures) and the mismatch between the package's declared purpose and its behavior strongly indicate malicious code designed to execute unauthorized binaries.

This malicious package can execute arbitrary native binaries on the host system without user consent, potentially leading to system compromise, data theft, persistence, or further malware deployment. The execution of unverified binaries from external, dynamically resolved hosts poses a significant security risk.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.9.1) of 'checkout-base-analytics-data' from their environments and avoid using this package. Monitor for any presence of the disguised binaries in temporary directories and investigate any suspicious processes spawned by this package. Consider using trusted package sources and verifying package integrity before installation.