The 'checkout-pay-widget-logic' npm package (version 35.3.2) includes malicious functionality where its index.js loads a vendor script that downloads a platform-specific binary over HTTPS from obfuscated Cloudflare Workers domains, with a DNS TXT record fallback mechanism to reassemble base64 chunks. The command-and-control hostnames are dynamically constructed at runtime to evade static detection. The downloaded binary is stored in temporary directories with disguised names mimicking legitimate Microsoft diagnostic tools, permissions are set to executable, and it is spawned detached from the parent process using shell commands. The package also contains a lock file and telemetry-labeled functions to provide a cover story, presenting itself as a log formatter. The malicious dropper runs by default unless explicitly disabled via environment variables.

This malicious package can execute arbitrary platform-specific binaries on the host system, potentially allowing unauthorized code execution and persistence. The use of obfuscated C2 hostnames and fallback DNS TXT record retrieval complicates detection and analysis. The disguised binary filenames and detached execution help evade casual inspection and automated defenses. This poses a significant risk to systems that install or run this package, enabling attackers to execute arbitrary code stealthily.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove 'checkout-pay-widget-logic' version 35.3.2 from their environments and avoid installing it. Monitor for any instances of this package and binaries with the described characteristics in temporary directories. Consider environment variable opt-outs if applicable, but removal is the primary mitigation. Verify dependencies and use trusted package sources to prevent supply chain compromise.