The 'checkout-desktop-promocode' npm package (version 35.4.3) is a malicious package that, upon require(), loads a script that selects a platform-specific endpoint and downloads a binary over HTTPS from obfuscated, attacker-controlled hosts. It uses runtime assembly of command-and-control hostnames to evade static detection and employs a DNS-TXT chunked base64 covert channel as a fallback. The downloaded binary is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package does not provide any promocode functionality and solely serves to execute arbitrary attacker code on the host system.

Importing this package leads to arbitrary code execution on the host system, allowing attackers to run any code with the privileges of the user installing the package. This can result in full system compromise, data theft, persistence, or further malware deployment. The malicious behavior is triggered simply by requiring the package, without any additional user interaction.

No official patch or remediation is currently available. Users should avoid installing or importing the 'checkout-desktop-promocode' package version 35.4.3. Remove any installations of this package from systems and audit for potential compromise. Monitor for suspicious network connections to the listed malicious domains. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.