The 'checkout-use-disable-interaction' npm package (version 35.4.9) includes malicious functionality where its index.js loads a _vendor.js script that downloads a native binary payload from Cloudflare Workers subdomains (oob-worker.cf*.workers.dev) and fallback DNS TXT records under *.dl.wel1.ru. The hostnames for the payload are dynamically assembled at runtime to evade static detection. The binary is written to temporary directories on Linux/macOS (/var/tmp/.cache_<uid>) or Windows (%TEMP%\dotnet_diag_<uid>.exe) with filenames designed to blend into system artifacts, then made executable and launched detached from the main process. A marker file is created to gate re-execution approximately every 6 hours, ensuring persistence whenever the package is imported. The package's README misrepresents its functionality as a benign microservice module, concealing the malicious behavior.

This malicious package enables unauthorized code execution on systems that import it, potentially allowing attackers to run arbitrary native binaries with the privileges of the user running the Node.js process. The payload's persistence mechanism and obfuscation techniques increase the difficulty of detection and removal. This can lead to system compromise, data theft, or further malware deployment depending on the payload's capabilities.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.4.9) of the 'checkout-use-disable-interaction' package from their environments. Avoid using this package until a trustworthy, clean version is available. Monitor for unexpected binaries in temporary directories matching the described patterns and remove any suspicious files. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages.