The 'checkout-mobile-pay-button' npm package version 20.8.3 is a malicious package masquerading as a mobile pay button platform adapter. Upon loading, it requires a loader script that reconstructs attacker-controlled hostnames using obfuscated string operations. It downloads a platform-specific binary from these domains, writes it to temporary directories under disguised filenames, sets executable permissions, and executes it detached from the main process. Additionally, it uses a DNS TXT record covert channel as a fallback delivery mechanism. The package's exported class is a non-functional stub, with the sole purpose of fetching and executing opaque attacker-controlled code on the host system.

Any system with this package installed or running is considered fully compromised, as the package downloads and executes arbitrary attacker-controlled binaries. This can lead to complete system takeover, data theft, and persistent malicious presence. All secrets and keys stored on the compromised system should be assumed exposed and require immediate rotation from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the 'checkout-mobile-pay-button' package version 20.8.3 immediately from all affected systems. Consider all affected systems fully compromised and perform a thorough incident response, including rotating all secrets and keys from a different, uncompromised machine. There is no known patch or official fix for this malicious package. Prevention includes avoiding installation of untrusted or suspicious npm packages and verifying package provenance before use.