The 'checkout-create-token' npm package (version 35.5.6) masquerades as a token-generation library but includes hidden malicious functionality. Its main entry point loads a secondary script '_platform.js' which initiates contact with command-and-control servers by constructing hostnames and using DNS TXT record lookups to retrieve base64-encoded payloads. It downloads a platform-specific binary via HTTPS, writes it to temporary directories under decoy filenames, sets executable permissions on POSIX systems, and executes the binary in a detached process. The package uses environment variables such as DISABLE_TELEMETRY and ANALYTICS_OPT_OUT to mimic legitimate telemetry and evade detection. This behavior is unrelated to the package's stated purpose and represents a supply chain compromise.

This malicious package can lead to unauthorized code execution on systems where it is installed, potentially allowing attackers to run arbitrary binaries with the privileges of the user executing the package. The downloaded payloads are controlled by an attacker via command-and-control infrastructure, which can lead to further compromise, data exfiltration, or persistence mechanisms. The use of environment variables to disguise the activity may hinder detection by security tools.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.5.6 of 'checkout-create-token' from their environments and avoid installing this package. Employ trusted sources and verify package integrity before installation. Monitor for any binaries dropped in temporary directories with suspicious names. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.