The 'checkout-common-tokens' npm package version 20.1.6 includes malicious code in its index.js that loads an auxiliary script (_ext.js). This script dynamically constructs obfuscated URLs to fetch a binary payload over HTTPS from rotating Cloudflare Workers subdomains. The payload is saved to temporary system directories with names resembling legitimate telemetry files, permissioned for execution, and then spawned detached via shell commands. If the HTTPS fetch fails, the code uses a fallback covert channel via DNS-TXT record queries to reconstruct and execute the payload. The payload is unrelated to the package's documented functionality and runs with the privileges of the user installing or importing the package. This behavior results in full compromise of the host system.

Any system with this package installed or running is considered fully compromised. The attacker gains execution with the installer's privileges, allowing potential access to all secrets, keys, and sensitive data stored on the system. Removal of the package alone does not guarantee eradication of the malicious payload or any persistence mechanisms. Secret and key rotation from a trusted environment is mandatory.

Remove the 'checkout-common-tokens' package version 20.1.6 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on compromised systems using a different, trusted device. Because the malicious payload executes with installer privileges and may persist beyond package removal, consider full system reimaging or forensic analysis to ensure complete eradication. Monitor for any suspicious activity related to the package and its artifacts.