The 'checkout-create-draft-agreement-am' npm package (version 35.1.1) includes a malicious module (_polyfill.js) that downloads a native binary from multiple Cloudflare Workers hosts with obfuscated domain names. It employs a DNS-TXT covert channel on *.dl.wel1.ru domains to fetch base64-chunked payloads, which are then reassembled, written to disk in temporary locations, made executable, and executed detached via child_process.spawn using shell commands. No hash or signature verification is performed on the downloaded payloads. The malicious activity is disguised under telemetry opt-out labels, and the involved hosts have no legitimate relation to the package's intended functionality.

This malicious behavior allows arbitrary code execution on the host system where the package is installed, potentially leading to full system compromise. The lack of integrity checks on the downloaded payload increases the risk of executing untrusted and potentially harmful binaries. The covert DNS-TXT channel and obfuscated domains complicate detection and analysis.

No official patch or remediation guidance is provided. Users should immediately avoid using version 35.1.1 of the 'checkout-create-draft-agreement-am' package. Remove any installations of this package from systems and audit for any suspicious processes or files created under /var/tmp/.cache_<uid> or Temp\dotnet_diag_<uid>.exe. Monitor for network connections to the identified suspicious domains. Consider using trusted package sources and verifying package integrity before installation.