The 'checkout-create-pos-order-am' npm package (version 20.9.5) contains malicious code that, when loaded, dynamically selects a platform-specific native binary and downloads it from non-publisher Cloudflare Workers hosts. It uses obfuscated domain assembly and DNS TXT record covert channels to evade detection. The binary is saved to temporary directories under disguised names, permissions are set to executable, and it is spawned detached from the main process. The package does not have any legitimate reason to fetch or execute such binaries, indicating a supply chain compromise or intentional malware distribution. The downloaded payload is unverified, posing a high risk of arbitrary code execution and full system compromise.

Systems with this package installed or running are considered fully compromised. The malicious binary grants attackers full control over the affected computer, potentially exposing all stored secrets and keys. Immediate rotation of all credentials from a secure environment is required. Removal of the package alone does not guarantee eradication of the malware due to possible persistence mechanisms established by the attacker.

Remove the 'checkout-create-pos-order-am' package version 20.9.5 immediately from all systems. Rotate all secrets and keys stored on affected computers from a separate, trusted device. Since the package downloads and executes unverified native binaries from external hosts, do not rely solely on package removal; conduct a thorough incident response to identify and remediate any persistent malicious components. Monitor for any suspicious activity related to this package and block network access to the identified malicious domains if possible.