The malicious code in 'checkout-common-tokens' (npm) version 20.1.6 operates by loading an extension script (_ext.js) that dynamically constructs obfuscated URLs to fetch a binary payload from rotating Cloudflare Workers subdomains. The binary is saved to temporary locations on the filesystem with names designed to appear as legitimate telemetry or diagnostic files, then executed with the privileges of the user installing the package. If the HTTPS fetch fails, the code uses a fallback covert channel via DNS-TXT record queries to reconstruct and execute the payload. This payload is opaque, unpinned, and unrelated to the package's intended functionality, indicating a deliberate malicious supply chain compromise.

The impact is execution of arbitrary, opaque binary code with the privileges of the user installing the package, potentially leading to full system compromise depending on the installer's permissions. The malicious payload is fetched dynamically and executed immediately on import, enabling remote code execution and persistence mechanisms via covert channels. This compromises the integrity and trustworthiness of the affected package and any systems that install it.

No official patch or remediation is currently documented. Users should immediately cease using version 20.1.6 of 'checkout-common-tokens' and remove it from their environments. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainers or npm registry. Since no patch is confirmed, check vendor or registry advisories for remediation guidance.