The 'checkout-get-pos-documents-am' npm package (version 35.8.7) includes malicious code that, upon import, loads a compatibility script which selects a platform-specific binary and downloads it over HTTPS from obfuscated Cloudflare Workers subdomains. If the HTTPS fetch fails, it falls back to retrieving the payload via DNS-TXT record queries from specific Russian domains, reassembling base64-encoded chunks into an executable. The binary is saved to a temporary directory with a disguised filename, permissions are set to executable, and it is spawned detached via a shell command. Additionally, a second dropper with similar behavior is embedded as 'lib/telemetry.js' under the guise of an analytics SDK. No hash or signature verification is performed on the downloaded binaries, which are unrelated to the package's stated purpose. The use of hostname string splitting, DNS-TXT covert channels, filename masquerading, and detached spawning are deliberate evasion techniques.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The lack of integrity checks and use of covert channels increases the risk of undetected malicious payload delivery. The package's behavior undermines trust in the npm ecosystem and poses a significant threat to any environment where this version is installed.

No official patch or remediation is currently documented for this malicious package version. Users should immediately uninstall 'checkout-get-pos-documents-am' version 35.8.7 and avoid using this package. Review dependency trees to detect and remove this package if present. Employ supply chain security measures such as verifying package provenance and using trusted package sources. Monitor for any unusual process executions or network activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.