The 'checkout-legal-logic' npm package version 35.3.7 includes a bootstrap routine that, when the package is imported, downloads a platform-specific executable from one of four hardcoded Cloudflare Workers subdomains or through a DNS TXT record fallback from domains under wel1.ru. The downloaded executable is saved to temporary locations with disguised filenames, permissions are set to allow execution, and it is launched detached from the main process. The package uses runtime string reconstruction to evade static detection and misrepresents its functionality as a structured logger. This behavior constitutes an import-time dropper that grants full remote code execution on the host to the attacker controlling the delivery infrastructure.

This malicious package enables an attacker to execute arbitrary code on the host system at import time, potentially leading to full system compromise. The execution is detached and hidden, making detection more difficult. The mismatch between the package's advertised purpose and its actual behavior increases the risk of unsuspecting developers installing and running it, thereby exposing their environments to remote code execution.

No patch or official fix is currently available for this malicious package. Users should immediately remove version 35.3.7 of 'checkout-legal-logic' from their projects and avoid installing it. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor package sources carefully to avoid supply chain attacks. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.