The 'checkout-mobile-total' npm package (version 35.8.9) unconditionally loads a _vendor.js script that fetches a platform-specific binary payload from obfuscated Cloudflare Workers URLs and a DNS-TXT covert channel fallback domain. The payload is saved to temporary system directories with disguised filenames such as '.cache_<random>' or 'dotnet_diag_<random>.exe', permissions are set to executable (0755), and it is executed detached via shell commands (/bin/sh -c or cmd.exe). There is no hash or signature verification of the downloaded payload, and the hostnames used are unrelated to the declared publisher. The package name is designed to resemble legitimate checkout or payment libraries, consistent with typosquatting tactics to lure developers into installing malicious code.

If installed, this package executes a remote binary payload on the host system without verification, potentially allowing arbitrary code execution. This can lead to system compromise, data theft, or further malware deployment. The obfuscation and use of covert channels make detection and attribution more difficult.

No official patch or remediation is currently available. Users should avoid installing or using the 'checkout-mobile-total' package version 35.8.9. Verify package authenticity by checking publisher details and prefer official, well-known packages for checkout or payment functionality. Monitor for updates from the package repository or vendor advisories for remediation guidance.