The checkout-mobile-pay-button package version 20.8.3 is a malicious npm package designed to execute arbitrary attacker-controlled code on the host system. Upon loading, it requires a loader script that reconstructs obfuscated attacker-controlled hostnames to download a platform-specific binary via HTTPS. This binary is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the parent process. Additionally, the package uses a DNS TXT record covert channel as a fallback to deliver payloads if the primary download fails. The exported CheckoutMobilePayButton class is a non-functional stub, indicating the package's sole purpose is malicious code execution.

This package allows remote attackers to execute arbitrary code on the host system where the package is installed, potentially leading to full system compromise. The malicious binary is downloaded and executed without user consent, bypassing normal security controls. The use of covert DNS channels complicates detection and mitigation.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. Users should immediately remove the package [email protected] from their environments and audit systems for any signs of compromise. Avoid installing packages from untrusted sources and verify package authenticity before use.