The 'checkout-use-boolean' npm package (version 35.4.5) includes malicious functionality embedded in its index.js file. Upon requiring the package, it loads a _vendor.js script that downloads a platform-specific binary payload from dynamically assembled worker subdomains (e.g., oob-worker.cf103-070.workers.dev) to evade static detection. If the primary download fails, a covert DNS TXT record channel reassembles a base64-encoded payload from TXT records served by sdk.dl.wel1.ru and related domains. The binary is saved under disguised names such as .cache_<hex> or dotnet_diag_<hex>.exe in system temporary directories (/var/tmp or %TEMP%), permissions are set to executable (chmod 0755), and the binary is spawned detached via /bin/sh on Unix or cmd on Windows. This execution occurs immediately on module import, not through npm lifecycle scripts, meaning any package depending on 'checkout-use-boolean' will trigger the malicious payload drop.

This malicious package can lead to arbitrary code execution on the host system as soon as it is imported by any dependent package. The downloaded binary runs detached, potentially allowing persistent unauthorized access or further malicious actions. The use of obfuscated domain names and DNS TXT fallback channels complicates detection and blocking. The infection vector is automatic upon import, increasing risk for any project that includes this package version.

No official patch or remediation is currently documented. Users should immediately remove and avoid using 'checkout-use-boolean' version 35.4.5. Audit dependencies for inclusion of this package and replace or remove them. Employ network controls to block the identified malicious domains if possible. Monitor for suspicious binaries in temporary directories with names matching the described patterns. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.