The 'checkout-mobile-promocode' npm package version 35.6.9 includes malicious functionality embedded in its index.js and lib/telemetry.js files. These scripts reconstruct obfuscated destination hostnames from split string literals to evade static analysis. They then download unpinned, unverified native executables from several *.workers.dev and *.dl.wel1.ru domains. The executables are saved to temporary directories with disguised names such as 'dotnet_diag_*.exe' or '.cache_*', permissions are set to executable (0755), and the binaries are spawned detached via shell commands. This results in arbitrary native code execution immediately upon requiring the package, with no legitimate functionality provided. The package name mimics a legitimate mobile checkout or promo code component to deceive users.

This malicious package enables remote attackers to execute arbitrary native code on the host system immediately upon import, potentially leading to full system compromise. The unverified and unpinned nature of the downloaded executables increases risk, as attackers can change payloads at will. The obfuscation techniques hinder detection by static analysis tools. There is no indication of targeted exploitation or active in-the-wild use yet, but the impact of successful execution is severe.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the 'checkout-mobile-promocode' package version 35.6.9. Verify the integrity and provenance of npm packages before use, especially those mimicking legitimate components. Employ runtime protection to detect and block suspicious child process spawning from npm packages. Monitor for updates or advisories from the package maintainers or npm registry regarding this malicious package.