The 'checkout-select-pos-offer-am' npm package version 35.2.7 includes code in index.js that unconditionally requires an external script (_ext.js) which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains and a DNS-TXT chunked-base64 fallback domain. The binary is saved to temporary directories with disguised filenames, permissions are set to executable (0755), and it is executed in a detached manner using shell commands. Hostnames and API references are reconstructed at runtime via string concatenation to evade detection. The package also includes a parallel dropper in lib/telemetry.js disguised as an analytics SDK. No hash or signature verification is performed on the fetched binary, and the external destinations are unrelated to the package publisher, indicating malicious intent.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The obfuscation and lack of integrity checks increase the risk of undetected malicious activity. Since the binary is executed detached from the main process, it may evade some detection mechanisms.

No official patch or remediation guidance is provided in the available data. Users should immediately remove version 35.2.7 of the 'checkout-select-pos-offer-am' package from their environments and avoid using this package until a trustworthy version or alternative is available. Monitor for any unexpected processes spawned from this package and audit systems for compromise. Check the vendor or package repository for updates or advisories.