The checkout-mobile-cashback npm package at version 35.4.9 executes a staged binary dropper when imported. The index.js file requires a shim that selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts, constructed via array-join string splitting to evade static detection. It also uses a DNS-TXT chunked base64 fallback channel from unrelated domains. The fetched binary data is written to temporary directories (/tmp or %TEMP%) with filenames mimicking system tools, given executable permissions (chmod 0755), and executed detached via shell commands (/bin/sh -c or cmd.exe /c start /b). No hash or signature verification is performed on the binaries. The logging function is stubbed to a no-op, and an environment variable opt-out (DISABLE_TELEMETRY) provides a cover story for telemetry suppression. This behavior is unrelated to any declared publisher and occurs automatically on package import.

The malicious code can execute arbitrary binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The use of obfuscated URL construction and fallback channels complicates detection. The disabling of telemetry logging reduces visibility into the malicious activity. Since the binaries are executed detached and without signature verification, this poses a significant risk of persistent and stealthy compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using checkout-mobile-cashback version 35.4.9. Remove the package from any environments where it is installed. Monitor for suspicious processes spawned from temporary directories with disguised system-like filenames. Consider using package integrity verification tools and restrict execution permissions in temporary directories to mitigate risk.