The 'checkout-desktop-accounts' npm package version 35.7.4 includes a malicious loader (_loader.js) that reconstructs C2 hostnames from fragments and uses DNS TXT records under specific domains as a covert channel to retrieve a base64 payload. It downloads a platform-specific executable over HTTPS, saves it to temporary locations with names mimicking legitimate Microsoft tools, sets executable permissions, and spawns it detached using shell commands. A hidden file (.analytics_state) is used to gate re-execution, and environment variables DO_NOT_TRACK and DISABLE_TELEMETRY are honored to present a facade of cooperative telemetry. This behavior constitutes a remote code execution dropper triggered on any require of the package.

This malicious package enables remote code execution on any system that requires it, potentially allowing attackers to run arbitrary code with the privileges of the user running the Node.js process. The use of covert DNS channels and disguised binaries complicates detection and forensic analysis. The presence of a hidden stamp file prevents repeated execution, which may help evade some detection mechanisms. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using version 35.7.4 of the 'checkout-desktop-accounts' package. Remove the package from your environment if already installed and monitor for any suspicious activity related to its use.