The 'checkout-public-tokens' npm package (version 35.4.9) includes a module (_platform.js) that downloads a binary payload from multiple obfuscated, hardcoded domains. The domains are constructed at runtime by joining split string literals, and a DNS-TXT base64 fallback resolver is used for additional hosts. The downloaded payload is saved to temporary directories with disguised filenames such as '.cache_<hex>' or 'dotnet_diag_<hex>.exe', permissions are set to executable (0755), and the payload is executed detached via shell commands (/bin/sh -c or cmd.exe /c start /b). The package advertises this behavior as telemetry, analytics, and cache validation, but these claims are inconsistent with the observed behavior. No hash or signature verification of the downloaded payload is performed, indicating a high risk of arbitrary code execution.

This malicious behavior allows the package to execute arbitrary code on the host system without user consent or verification, potentially leading to system compromise, data theft, or further malware deployment. Because the payload is downloaded from external, untrusted hosts and executed without validation, the risk includes remote code execution and persistence on affected systems.

No official patch or remediation is currently documented for this package version. Users should immediately avoid using 'checkout-public-tokens' version 35.4.9 and remove it from their environments. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes or files matching the described patterns in temporary directories. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.