The npm package 'checkout-accounts-logic' version 35.9.2 contains malicious code that loads a native binary from attacker-controlled servers. This binary is fetched, saved with a disguised name, given execute permissions, and run detached from the main process. The package masquerades as a log formatter but has no legitimate reason to execute native code. It uses DNS TXT record lookups as a fallback for command and control (C2) hostnames, indicating sophisticated evasion techniques. No official patch or remediation guidance is currently available.