The 'checkout-mobile-input-email' npm package version 35.6.8 includes malicious code in its index.js and _helpers.js files. It constructs hostnames from string arrays to reach anonymous Cloudflare Workers subdomains, from which it downloads a platform-specific binary. This binary is saved to temporary directories with disguised names (e.g., .cache_<hex>, .analytics_state, dotnet_diag_<hex>.exe), given executable permissions, and spawned detached via shell commands. Additionally, a large telemetry.js file is included but not directly required, potentially referenced or replaced by the native binary. The package uses a secondary exfiltration or download channel through base64-encoded DNS-TXT fallback resolvers under *.dl.wel1.ru. These actions are malicious and unrelated to the package's intended functionality.

This malicious package can execute arbitrary native code on the host system by downloading and running a binary from attacker-controlled infrastructure. This can lead to system compromise, data exfiltration, or further malware deployment. The use of anonymous Cloudflare Workers subdomains and DNS-TXT fallback channels complicates detection and mitigation. The threat affects any environment where this specific version of the package is installed and executed.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.6.8 of 'checkout-mobile-input-email' from their projects and replace it with a trusted alternative or a verified clean version if available. Monitor for any unexpected binaries or processes spawned from temporary directories with suspicious names. Check vendor advisories or trusted security sources for updates or official fixes. Avoid using this package version until further notice.