The 'checkout-confirm-pos-order-sms-am' npm package (version 35.6.4) includes a malicious init() function that triggers on require(). This function downloads a binary payload from dynamically reconstructed Cloudflare Workers URLs or via DNS-TXT records from specified domains. The payload is saved to a temporary location with disguised filenames mimicking legitimate tools, permissions are set to executable, and it is launched detached from the Node.js process. The package employs obfuscation techniques such as string splitting of critical Node.js APIs (require('child_process'), fs.chmodSync, spawn) and base64 chunk assembly to evade static analysis. The malicious payload runs persistently and independently, enabling attacker-controlled native code execution on the host machine. The package name is a lookalike of a legitimate checkout/POS SMS confirmation utility, increasing the likelihood of installation by unsuspecting users.

Installing or requiring this package results in execution of attacker-controlled native code on the affected system. This can lead to full compromise of the host, including unauthorized code execution, persistence, and potential further malicious activity. The obfuscation and persistence mechanisms increase the difficulty of detection and removal.

No official patch or remediation is currently available. Users should immediately uninstall the 'checkout-confirm-pos-order-sms-am' package version 35.6.4 and avoid installing or requiring this package. Conduct a thorough investigation of any systems where this package was installed to detect and remove any dropped binaries or persistent processes. Monitor for suspicious activity related to the described domains and binaries. Since this is a malicious package, rely on trusted package sources and verify package integrity before installation.