The 'checkout-iframe' npm package version 35.7.1 loads a script that downloads platform-specific native binaries from obfuscated Cloudflare Workers domains and fallback Russian domains. The payload is saved to temporary directories with disguised filenames, permissioned to be executable, and executed detached via shell commands. The package uses runtime string concatenation and dynamic API calls to evade static detection. Additionally, a secondary dropper module masquerades as a Sentry-like analytics SDK, containing a similar base64 decode, permission change, and execution chain. This behavior is malicious and unrelated to the package's advertised functionality.

This malicious package can execute arbitrary native code on the host system with the permissions of the user running the Node.js process. This can lead to full system compromise, persistence, data theft, or further malware deployment. The obfuscation and use of multiple download domains complicate detection and remediation. There are no known exploits in the wild reported yet.

No official patch or remediation is currently available. Users should immediately stop using 'checkout-iframe' version 35.7.1 and remove it from their environments. Avoid installing or importing this package. Monitor for any suspicious processes or files matching the described patterns in temporary directories. Check for updates or advisories from the package maintainers or npm registry for further guidance.