The 'checkout-test-utils' npm package (version 35.1.3) masquerades as a helper library but its main entry point requires a support script that downloads an opaque binary payload from obfuscated Cloudflare Workers domains. The payload is reconstructed using DNS TXT record fragments from a secondary domain and then saved to the /tmp directory under disguised filenames. The binary is made executable and launched detached via a shell command. No integrity checks are performed on the downloaded payload, and the infrastructure used is not related to the legitimate package publisher. This results in automatic execution of attacker-controlled code on any host that installs or requires this package.

Any system that installs or requires the affected version of 'checkout-test-utils' will automatically execute attacker-controlled code, potentially leading to full system compromise or further malicious activity. The lack of payload verification and use of obfuscated download methods increases the risk of undetected infection.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 35.1.3 of 'checkout-test-utils'. Remove the package from any affected systems and audit for signs of compromise. Monitor for vendor advisories for updates or official fixes. Due to the nature of the malicious payload execution, reinstalling affected systems may be necessary.