The checkout-format-money npm package at version 35.8.6 includes embedded malicious code that triggers remote code execution when the package is loaded. The index.js file requires setup.js, which reconstructs obfuscated destination hostnames and performs DNS-TXT discovery to fetch an opaque binary from attacker-controlled servers. The binary is saved to temporary directories under disguised names, permissions are set to executable, and it is spawned detached via shell commands on Unix or Windows. A secondary loader with similar behavior is embedded in lib/telemetry.js, which base64-decodes a payload, writes it to disk, sets executable permissions, and executes it. The use of string-split obfuscation, disguised filenames, and unpinned payloads from attacker-controlled hosts confirms the package is malicious and designed to run arbitrary code with the privileges of the user installing the package.

Any environment that installs and requires checkout-format-money version 35.8.6 will execute attacker-controlled binaries with the installer's privileges, leading to full remote code execution. This can result in complete system compromise, data theft, persistence, or further malware deployment. The malicious payload runs detached and stealthily, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing checkout-format-money version 35.8.6. Audit existing environments for the presence of this package and any suspicious binaries in temporary directories. Since no patch is available, the best mitigation is to cease use and replace the package with a trusted alternative. Monitor for any unusual processes spawned from temporary directories and investigate accordingly.