The 'checkout-types' npm package version 35.6.8 includes malicious code embedded in its index.js file. Upon requiring the package, it loads a _vendor.js script that reconstructs command-and-control (C2) server hostnames from split string arrays and uses DNS TXT record fallback channels for resilience. It downloads a platform-specific binary from these C2 servers, saves it to a temporary path with deceptive filenames (e.g., dotnet_diag_<random>.exe on Windows), sets executable permissions (chmod 0755), and executes the binary detached from the main process using shell commands. This results in arbitrary code execution on the host machine at module load time without user interaction.

This malicious package enables attackers to execute arbitrary code on any system that installs and requires the affected version of 'checkout-types'. The attack occurs immediately upon requiring the package, potentially compromising the host system's integrity, confidentiality, and availability. The use of obfuscation and DNS covert channels complicates detection and mitigation.

No official patch or remediation is currently available for this malicious package version. Users should immediately avoid installing or requiring 'checkout-types' version 35.6.8. If already installed, remove the package and scan affected systems for suspicious binaries and processes. Monitor for any unusual network activity related to the described C2 domains. Use trusted sources and verify package integrity before installation.