The 'checkout-use-toasts' npm package (version 35.3.6) loads a script that fetches OS and architecture-specific native binaries from runtime-assembled Cloudflare workers.dev hosts using obfuscated hostnames and a DNS-TXT fallback channel. The fetched payload is base64-decoded, written to temporary locations with disguised filenames, given executable permissions, and executed detached from the main process. This covert channel bypasses HTTP egress controls, and the package's legitimate purpose (toast notifications) does not align with downloading and executing native code. Installing or importing this package leads to attacker-controlled code execution on the host machine.

Installing or importing the affected version of the 'checkout-use-toasts' package results in execution of attacker-controlled native binaries on the user's machine, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until a fix is available, avoid installing or importing the 'checkout-use-toasts' package version 35.3.6. Consider removing the package from existing environments and scanning for its presence.