The npm package 'checkout-total-logic' version 35.8.3 contains malicious code that, upon being required, downloads and executes platform-specific binaries from untrusted external hosts without verification. This behavior enables unauthenticated remote code execution on any developer or CI host that installs and uses the package. The package masquerades as a trivial log transport, hiding its true malicious intent.