The 'checkout-mobile-legal' npm package (version 35.8.8) contains malicious code that, upon require or import, loads a script that dynamically constructs hostnames to download an opaque binary from Cloudflare Workers subdomains controlled by the package author. This binary is saved to temporary directories with disguised filenames, given executable permissions, and executed without any signature or publisher verification. If HTTPS retrieval fails, a covert channel using DNS-TXT records from specific subdomains reassembles and executes a base64-encoded payload to bypass egress HTTP filtering. The package uses misleading filenames and marker files to disguise its behavior as telemetry software. This results in arbitrary remote code execution on the installer's host.

Installing or importing this package version grants the package author the ability to execute arbitrary code on the host system. This can lead to full compromise of the affected system, unauthorized access, data theft, or further malware deployment. The use of obfuscation and fallback mechanisms increases the difficulty of detection and prevention.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or importing 'checkout-mobile-legal' version 35.8.8. Verify package integrity and source before installation. Consider removing the package if already installed. Monitor for updates from trusted sources or advisories regarding remediation.