The package 'checkout-resend-pos-order-sms-am' version 35.3.3, when required, loads a polyfill script that reconstructs attacker-controlled hostnames and downloads native executables via HTTPS. These executables are saved to temporary directories with disguised filenames and executed with elevated permissions. The code uses runtime string concatenation to evade static detection of key functions like 'child_process' and 'chmodSync'. A fallback mechanism uses DNS-TXT records to retrieve payload chunks if direct HTTPS fetching fails. A sibling telemetry module shares the same malicious infrastructure, indicating coordinated payload delivery. This activity is unrelated to the package's legitimate purpose as an SMS/POS order helper, confirming its malicious intent.

The malicious code enables remote attackers to execute arbitrary native code on the host system by downloading and running platform-specific executables. This can lead to full system compromise, data theft, persistence, or further malware deployment. The obfuscation and fallback mechanisms increase the likelihood of successful payload delivery and evasion of detection tools.

No official patch or remediation guidance is provided. Users should immediately discontinue use of version 35.3.3 of 'checkout-resend-pos-order-sms-am' and remove it from their environments. Avoid installing or running this package from untrusted sources. Monitor for suspicious processes or files matching the described patterns. Since no fix is confirmed, check vendor advisories or trusted security sources for updates.