The 'checkout-mobile-accounts' npm package version 35.6.8 contains embedded malicious functionality that triggers on module import. It loads a platform-specific JavaScript file (_platform.js) that constructs obfuscated hostnames at runtime to download an executable payload from multiple worker.dev subdomains and a Russian domain, with a DNS-TXT covert channel fallback for payload retrieval. The payload is saved to system temporary directories under deceptive filenames (e.g., dotnet_diag_<hex>.exe on Windows, .cache_<hex> on Unix), permissions are set to executable (chmod 0755), and the payload is executed detached via shell commands (/bin/sh -c or cmd.exe). A lock file named .analytics_state is created to blend in as legitimate telemetry data. The package's behavior is inconsistent with its advertised purpose and lacks native source code that would justify fetching and executing remote binaries at import time.

This malicious package can lead to arbitrary code execution on the host system when the package is imported, potentially allowing attackers to run unauthorized executables with the privileges of the importing process. The use of obfuscated hostnames and covert DNS-TXT fallback channels complicates detection and analysis. The deceptive file naming and telemetry masquerading increase the likelihood of evading user suspicion and automated defenses.

No official patch or remediation is currently documented for this package version. Users should avoid using 'checkout-mobile-accounts' version 35.6.8 and remove it from their projects. Consider auditing dependencies for similar malicious behavior. Monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package, replacing it with a trusted alternative or removing it entirely is recommended.