The 'checkout-input-card-logic' npm package (version 35.8.8) includes a malicious payload that activates on require(). It loads a script (_vendor.js) which dynamically assembles obfuscated hostnames to download a platform-specific binary from Cloudflare Workers subdomains. If that fails, it uses a chunked base64 DNS-TXT fallback via *.dl.wel1.ru. The downloaded binary is saved to temporary directories with cover names such as '.cache_<rand>', 'dotnet_diag_<rand>.exe', or 'analytics_state', given executable permissions (chmod 0755), and executed detached via shell commands (/bin/sh -c or cmd.exe). There is no hash or signature verification of the binary, and the delivery hosts do not match the package publisher, indicating a supply-chain compromise designed to drop and run arbitrary native code.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, persistence, or further malware deployment. The lack of integrity checks and obfuscation techniques increase the risk of undetected exploitation in environments that install this package.

No official patch or remediation is currently documented. Users should immediately avoid using version 35.8.8 of 'checkout-input-card-logic'. Remove the package from all environments and replace it with trusted alternatives. Monitor for any unusual processes spawned from temporary directories with suspicious filenames. Check vendor advisories or npm security notices for updates or official guidance.