The 'checkout-mobile-input-card' npm package (version 35.7.7) includes malicious functionality triggered on require(). It loads a shim script that downloads a platform-specific binary payload from obfuscated Cloudflare Workers subdomains, with a fallback mechanism using DNS TXT records to reassemble a base64-encoded binary. The payload is saved to temporary directories on Unix or Windows systems, given executable permissions, and launched detached via shell commands. The code uses string-splitting obfuscation to hide key identifiers such as 'child_process' and 'chmodSync'. This package impersonates a legitimate checkout or payment input component to deceive users and automated scanners.

If installed and required, this package executes a downloaded binary on the host system with the ability to run arbitrary code. This can lead to full system compromise, unauthorized persistence, data theft, or further malware deployment. The obfuscation and use of covert DNS channels make detection and analysis more difficult.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.7.7) of the 'checkout-mobile-input-card' package from their projects and avoid using this package. Verify dependencies and supply chain integrity to prevent installation of malicious packages. Monitor for any suspicious activity related to this package and consider using trusted package sources and integrity verification tools.