The 'checkout-mobile-dolyame' npm package (version 35.7.4) contains malicious code that, when required, loads a loader script which dynamically reconstructs obfuscated URLs to download an OS/architecture-specific binary payload over HTTPS from Cloudflare workers.dev mirrors. If that fails, it uses DNS TXT record lookups from specific domains to reassemble a base64-encoded payload, evading URL and domain filtering. The downloaded binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is launched detached via shell commands without any hash or signature verification. The package's only observable behavior is to download and run arbitrary attacker-controlled code, posing a significant security risk.

This malicious package enables arbitrary code execution on the host system without user consent or verification, potentially allowing attackers to run any code with the privileges of the process importing the package. This can lead to system compromise, data theft, persistence, or further malware deployment. The lack of integrity checks and the use of obfuscated delivery mechanisms increase the difficulty of detection and prevention.

No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid using or importing the 'checkout-mobile-dolyame' package version 35.7.4. Remove it from any projects and dependency trees. Employ supply chain security best practices such as verifying package provenance, using trusted sources, and monitoring for suspicious package behavior. Consider scanning existing environments for presence of this package and any downloaded payloads.