The 'checkout-postpone-until-render' npm package version 35.2.4 includes malicious code embedded in its index.js and lib/telemetry.js files. Upon requiring the package, it constructs obfuscated Cloudflare Workers hostnames and downloads a platform-specific binary via HTTPS with a DNS-TXT fallback from *.dl.wel1.ru. The binary is saved to temporary directories (/var/tmp or %TEMP%), given executable permissions (chmod 0755), and executed detached via shell commands. Execution is conditioned on environment variables and a temporary file flag to avoid repeated runs. The telemetry.js file contains a similar drop-and-execute routine disguised as an analytics SDK, which base64-decodes and executes additional code. The remote payload is unpinned and unverified, and the code uses string concatenation to evade static detection. This malicious behavior is unrelated to the package's intended purpose.

This malicious package can execute arbitrary code on the host system by downloading and running unverified binaries, potentially leading to full system compromise. The obfuscation and fallback mechanisms make detection and blocking more difficult. Because the payload is remote and unpinned, the attacker can change it at will, increasing the risk of further malicious actions. The execution of code is gated but can be triggered in typical development or deployment environments that do not set the specified environment variables or flags.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.2.4 of 'checkout-postpone-until-render' from their projects and avoid using this package. Verify dependencies for integrity and consider replacing this package with a trusted alternative. Monitor for any unexpected execution of binaries from temporary directories. Since this is a malicious package, vendor advisories or patches are unlikely; remediation involves removal and dependency auditing.