The npm package 'checkout-base-test' version 35.9.3 contains malicious code that executes immediately upon import. It constructs attacker-controlled hostnames to fetch a binary payload, which it writes to temporary directories under disguised filenames mimicking legitimate diagnostic files. The payload is then executed detached from the main process. If the primary HTTPS hosts are unreachable, a DNS-TXT based covert channel is used as a fallback. The package uses evasion techniques such as dynamic string concatenation to hide child process usage and environment variable gating to control telemetry. The package name is deceptive and does not provide legitimate functionality.