This malicious npm package version 35.1.4 includes an _init.js script that, when required, detects the host operating system and architecture, then assembles obfuscated Cloudflare Workers hostnames from split string fragments. It uses a DNS TXT record fallback to *.dl.wel1.ru to download a platform-specific binary payload. The payload is saved to temporary directories with disguised filenames (e.g., dotnet_diag_<hex>.exe on Windows, .cache_<hex> on Unix), permissions are set to executable (chmod 0755), and the binary is spawned detached via /bin/sh or cmd.exe. No signature or hash verification is performed on the downloaded payload. The unconditional execution on module load and obfuscation techniques indicate malicious intent rather than legitimate telemetry.

The malicious code executes automatically when the package is loaded, potentially allowing execution of arbitrary code on the host system. The downloaded payload runs detached, which could enable persistence or further malicious activity. Lack of signature verification increases risk of executing untrusted code. This compromises system integrity and could lead to unauthorized control or data compromise.

No official patch or remediation is currently available. Users should immediately remove and avoid using version 35.1.4 of the 'checkout-get-installment-client-agreement-am' npm package. Verify the integrity of dependencies before installation and monitor for suspicious network activity related to the described domains. Consider using trusted package sources and scanning tools to detect malicious packages.