The 'checkout-test-component' npm package version 35.9.8 includes a malicious payload that triggers on require(). It loads a runtime script that fetches a platform-specific executable from attacker-controlled Cloudflare Workers hosts with a DNS TXT fallback to other malicious domains. The executable is saved to temporary directories with misleading filenames, permissioned to be executable, and launched detached via shell commands. Additionally, a secondary dropper is embedded in telemetry.js, which uses base64 chunk decoding and similar spawn and chmod techniques to deliver a dormant secondary payload. The package does not provide any legitimate functionality and is solely designed to execute attacker-controlled code on the host.

This malicious package can lead to arbitrary code execution on the host system where it is installed, potentially allowing attackers to run any code with the privileges of the user installing the package. This can result in system compromise, data theft, persistence, or further malware deployment. The malicious behavior activates immediately upon requiring the package, increasing risk of infection.

No official patch or remediation is currently documented. Users should immediately remove the 'checkout-test-component' package version 35.9.8 from their environments and avoid installing or requiring this package. Conduct a thorough investigation for potential compromise on systems where this package was used. Monitor for suspicious processes or files matching the described behavior. Check vendor advisories or trusted security sources for updates or official guidance.