The npm package 'checkout-common-tokens' version 20.1.6 contains malicious code that, upon import, downloads and executes a platform-specific binary payload from obfuscated Cloudflare Workers subdomains or, if that fails, via a covert DNS-TXT channel. The payload is executed with the installer's privileges and mimics legitimate diagnostic files. This results in full system compromise, potentially exposing all stored secrets and keys. Immediate removal and secret rotation are strongly advised.