The 'checkout-pay-button-logic' npm package version 35.3.8 includes malicious code that triggers on require. It invokes a helper script that selects a payload based on the operating system and fetches a native binary over HTTPS from obfuscated Cloudflare Workers hostnames, with a DNS-TXT base64 fallback from specific Russian domain resolvers. The binary is written to temporary locations with cover-story filenames such as 'analytics_state' or 'dotnet_diag', permissions are set to executable, and it is spawned detached via shell commands. The malware reads environment variables related to telemetry opt-out to appear legitimate. This behavior is unrelated to the package's intended purpose and indicates supply chain compromise or package hijacking.

The malicious code results in execution of an unauthorized native binary on the host system, potentially allowing arbitrary code execution. The use of obfuscated hostnames and fallback DNS resolvers complicates detection. The dropped payload runs detached and may evade casual inspection. This compromises the integrity and security of any environment that installs and requires this package version.

No official patch or remediation is currently documented. Users should avoid using version 35.3.8 of 'checkout-pay-button-logic'. Investigate and remove this package if present. Monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package version, replacing it with a clean, verified version or removing it entirely is recommended.