The 'checkout-mobile-accounts-old' npm package (version 35.6.6) includes a malicious module that, upon require(), loads a support script which downloads a native binary payload from specific Cloudflare Workers domains. It employs a DNS-TXT record covert channel fallback under the domain wel1.ru to reconstruct a base64-encoded binary from multiple TXT records. The payload is staged in temporary directories with disguised filenames, permissions are set to executable (chmod 0755 on POSIX), and the binary is executed detached via shell commands. Environment variables and a cooldown flag file are checked to suppress repeated fetches. This chain of actions results in full-host remote code execution on any system that installs this package, representing a severe compromise unrelated to the package's intended device integration functionality.

This malicious package enables attackers to execute arbitrary native code on the host system with the privileges of the installer process. The use of covert DNS-TXT channels for payload delivery and obfuscation techniques complicates detection and analysis. The impact is a full-host remote code execution compromise, potentially allowing complete control over affected systems.

No official patch or remediation is currently documented. Users should immediately cease using the 'checkout-mobile-accounts-old' package version 35.6.6 and remove it from their environments. Due to the lack of vendor advisory or patch information, verify the integrity of any systems that installed this package and consider rebuilding from known clean sources. Monitor for suspicious network activity related to the described C2 domains and DNS-TXT queries. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.