The 'checkout-subscription-holder' npm package (version 35.7.1) includes code that, upon being required, attempts to load a bootstrap script which reconstructs download URLs from obfuscated string arrays. It downloads an opaque binary from suspicious domains (including oob-worker.cf*.workers.dev and *.dl.wel1.ru), writes it to temporary locations on the host system, sets executable permissions, and executes it detached via shell commands. The filenames are crafted to appear as legitimate diagnostic tools or cache files. A marker file is used to control re-execution. This behavior is unrelated to the package's stated purpose, indicating it is a malicious package designed to execute unauthorized code.

Systems that install and run this specific version of the 'checkout-subscription-holder' package risk executing an unknown binary from attacker-controlled infrastructure. This can lead to arbitrary code execution on the host system with the privileges of the user running the package, potentially compromising system integrity and confidentiality.

No official patch or remediation guidance is provided. Users should immediately remove version 35.7.1 of the 'checkout-subscription-holder' package from their environments. Avoid installing this package and verify dependencies for any inclusion of this malicious version. Monitor for any unexpected binaries or processes matching the described behavior and remove them. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.