This malicious npm package, specifically version 35.7.9, executes a multi-stage attack by loading a compatibility script that fetches a platform-specific executable from hardcoded Cloudflare Workers endpoints. The executable is saved to temporary directories with decoy filenames, permissioned for execution, and launched detached via shell commands. To evade detection and bypass network restrictions, the package uses obfuscated hostnames and a DNS-TXT record fallback mechanism from multiple domains to retrieve base64-encoded payload fragments. A TTL stamp file is used to maintain persistence between executions. The package's advertised name does not reflect its malicious functionality, indicating deliberate deception.

The malicious package can execute arbitrary code on the host system by downloading and running executables without user consent. This can lead to unauthorized system compromise, persistence, and potential further malicious activity. The use of obfuscated endpoints and fallback DNS channels complicates detection and blocking efforts.

No official patch or remediation is currently documented. Users should avoid using the 'checkout-molecule-mobile-status-sheet' package version 35.7.9. Remove any installations of this package and audit systems for the presence of the downloaded executables and persistence files. Employ network controls to block the identified Cloudflare Workers hosts and the listed DNS domains used for fallback delivery. Monitor for suspicious processes spawned from temporary directories with decoy names.