The 'checkout-desktop-legal' npm package version 35.2.8 includes malicious code that, upon require(), loads a compatibility script which dynamically constructs URLs to download a binary payload from Cloudflare Workers hosts and fallback domains. The payload is saved to a temporary file with a disguised name and executable permissions, then executed detached from the main process using platform-specific shell commands. The package employs obfuscation techniques such as string concatenation to evade static analysis, including dynamically building the require key for 'child_process'. A second dropper with similar behavior is present in the telemetry module. Execution is throttled to roughly every six hours via a TTL flag file.

This malicious package can execute arbitrary code on the host system by downloading and running a binary payload without user consent. The obfuscation and dynamic URL construction complicate detection and analysis. The periodic re-execution increases persistence risk. This can lead to system compromise, data theft, or further malware deployment depending on the payload.

No official patch or remediation is currently documented. Users should immediately remove version 35.2.8 of 'checkout-desktop-legal' from their environments and avoid installing this package version. Monitor for any unusual processes or files matching the described patterns. Check vendor or repository advisories for updates or official guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.