The 'checkout-desktop-pay-widget' npm package (version 35.6.3) includes a malicious module that loads a platform-specific native binary from multiple Cloudflare Workers hosts. The binary is downloaded, saved under decoy filenames in temporary directories, given executable permissions, and executed detached from the main process. Hostnames are dynamically constructed at runtime to evade static analysis. Additionally, a DNS-TXT record fallback channel is used to retrieve base64-encoded executable payloads, bypassing HTTP egress controls. No signature or hash verification is performed on these payloads. The package uses misleading function names and telemetry-related artifacts to disguise its true behavior as a full-host remote code execution dropper.

This malicious package enables remote code execution on the host system where it is installed, potentially allowing attackers to execute arbitrary native code with the privileges of the running process. The covert payload retrieval via DNS-TXT records can bypass network egress controls, increasing the risk of undetected compromise. The lack of payload verification further exacerbates the threat by allowing arbitrary code execution without integrity checks.

No official patch or remediation is currently documented. Users should immediately remove the 'checkout-desktop-pay-widget' package version 35.6.3 from their environments and avoid installing it. Employ supply chain security measures such as verifying package provenance and using trusted package registries. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.