The 'checkout-todo-test' npm package (version 35.5.9) includes malicious functionality in its index.js and an unreferenced telemetry.js module. Upon requiring the package, it loads _platform.js which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers hosts. It also uses a DNS-TXT covert channel fallback to reconstruct a base64 payload from subdomain records. The downloaded binary is saved to a disguised temporary file, permissions are set to executable, and it is launched detached from the main process. No hash or signature verification is performed, and the infrastructure used is not controlled by the package publisher. This behavior is concealed under the guise of telemetry/analytics with environment variable opt-outs, but the use of runtime-reconstructed command-and-control destinations, DNS covert channels, and disguised on-disk artifacts indicates malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running binaries from attacker-controlled infrastructure without verification. This can lead to full system compromise, unauthorized data access, persistence, and further malicious activity. The covert DNS channel and obfuscation techniques hinder detection and analysis.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.5.9 of the 'checkout-todo-test' package. Audit dependencies for this package and replace with trusted alternatives. Monitor for any unexpected process executions or network connections related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.