The 'checkout-desktop-total' npm package version 35.6.1 includes a malicious routine triggered on requiring index.js. It downloads a platform-specific binary from Cloudflare Workers hosts using obfuscated hostnames and a DNS-TXT fallback mechanism. The binary is reconstructed from base64 chunks and saved to temporary directories under disguised filenames with executable permissions. It is then executed detached from the main process, hiding its presence. An on-disk marker file '.analytics_state' is also created. This behavior is deceptive and has no legitimate purpose for the package, indicating a supply chain compromise or malicious intent.

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary code with the privileges of the user running the Node.js process. The obfuscation and execution of binaries from external hosts pose a significant risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately remove the 'checkout-desktop-total' package version 35.6.1 from their projects and avoid using this package until a trusted update or advisory is released. Monitor for any unexpected binaries or marker files such as '.analytics_state' in temporary directories and investigate any suspicious processes spawned by Node.js. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages.