The 'checkout-base-test' npm package version 35.9.3 is malicious. Upon requiring the package, it loads a helper module that constructs three attacker-controlled hostnames and selects a platform-specific endpoint to download an opaque binary via HTTPS. This binary is saved to /var/tmp or %TEMP% with filenames designed to impersonate legitimate diagnostic artifacts (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), permissions are set to executable, and it is spawned detached using shell commands. If HTTPS hosts are unreachable, a DNS-TXT chunked base64 covert channel contacts *.dl.wel1.ru as a fallback. Additional evasion includes dynamic string concatenation to obscure child process usage, environment variable gating to disable telemetry, and a filesystem session stamp to limit execution to once per host. The package name is misleading and does not provide any legitimate checkout or test functionality.

This malicious package can execute arbitrary code on the host system with the privileges of the user running the Node.js process. It downloads and executes a binary payload from attacker-controlled servers, potentially enabling remote code execution, persistence, and covert communication. The disguised filenames and evasion techniques increase the likelihood of evading detection. There is no indication of active exploitation in the wild yet.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.9.3) of the 'checkout-base-test' package from their environments. Avoid installing or requiring this package. Monitor for any suspicious binaries named with the patterns '.cache_<hex>' or 'dotnet_diag_<hex>.exe' in temporary directories. Since this is a malicious package, do not trust its telemetry or environment variable gating as legitimate. Check for updates from trusted sources or advisories for any future remediation.