The 'checkout-desktop-cashback' npm package (version 35.4.6) includes malicious code in its index.js that loads a vendor script (_vendor.js). This script fetches a platform-specific binary payload from obfuscated Cloudflare Workers endpoints using array-joined hostnames to evade static detection. A DNS-TXT covert-channel fallback is used over *.dl.wel1.ru domains to retrieve base64-decoded chunked payloads. The binary is saved to temporary directories with disguised names ('.cache_<hex>' on POSIX systems and 'dotnet_diag_<hex>.exe' on Windows), permissions are set to executable (chmod 0755), and it is spawned detached via shell commands. Execution is throttled by a lock file and disguised with comments to avoid detection. The delivery infrastructure is anonymous and unrelated to the package publisher, and the binary is opaque, executed on every consumer requiring this package.

Consumers of the affected package version 35.4.6 are at risk of executing an unknown, opaque binary fetched from anonymous and mutable infrastructure controlled by the attacker. This can lead to unauthorized code execution on the host system, potentially compromising system integrity and confidentiality. The malicious payload is executed on every installation or require call, increasing exposure.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until a fix is available, avoid using version 35.4.6 of 'checkout-desktop-cashback' and remove it from your projects. Monitor for updates from the package maintainer or npm security team.