The 'checkout-total-logic' npm package (version 35.8.3) includes a module (_platform.js) that reconstructs endpoint hostnames from fragmented strings pointing to suspicious external domains. It performs HTTPS GET requests to these domains, downloads platform-specific binaries, saves them to temporary files with decoy names, sets executable permissions on Unix systems, and executes them detached from the main process. There is no hash or signature verification of the downloaded binaries, and the external hosts are unrelated to the package publisher. This results in unauthenticated remote code execution on any system that installs and requires this package.

Any developer or continuous integration environment that installs and requires this package version is at risk of remote code execution by an unauthenticated attacker controlling the external hosts. This can lead to full compromise of the affected host, including execution of arbitrary code under the privileges of the user running the Node.js process.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring 'checkout-total-logic' version 35.8.3. Investigate and remove this package from existing environments. Monitor for suspicious network connections to the identified external hosts. Check vendor advisories or trusted sources for updates or patches before reintroducing the package.