The 'checkout-desktop-pay-button' npm package version 35.5.4 includes a malicious import-time dropper. When required, it loads '_bootstrap.js' which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomains constructed via array-join concatenation. If that fails, it uses a DNS TXT record fallback mechanism that reassembles a base64-encoded payload from numbered TXT records under the domain net.dl.wel1.ru. The fetched binary is saved to temporary directories with disguised names such as 'dotnet_diag_<rand>.exe' or '.cache_<rand>', permissions are set to executable (0755), and it is spawned detached via shell commands. This behavior is unrelated to the package's declared purpose and is intended to evade detection through obfuscation and dynamic fetching of payloads.

The malicious code enables execution of arbitrary binaries on the host system without user consent or awareness, potentially leading to system compromise. The payload is dynamically fetched from obfuscated and evasive network locations, increasing difficulty of detection and blocking. This can result in unauthorized code execution, persistence, and further malicious activity on affected systems using this package version.

No official patch or remediation is currently documented for this malicious package version. Users should immediately cease use of 'checkout-desktop-pay-button' version 35.5.4 and remove it from their environments. Avoid installing or requiring this package from untrusted sources. Monitor for any unexpected processes spawned from temporary directories with suspicious names. Since this is a malicious package, remediation involves removing the package and any dropped binaries. Patch status is not yet confirmed — check the vendor or repository advisory for current remediation guidance.