If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224)
checkout-format-money@35.8.6 executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js reconstructs destination hostnames from split string arrays (e.g. 'oob-worker.cf101-adf'+'.wor'+'kers.de'+'v') and DNS-TXT discovery domains under a fallback of the form sdk/ext/pkg/net.dl.wel1.ru, fetches an opaque binary over https.get, writes it to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, sets it executable with fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',...) on Windows. A secondary loader with the same shape is bundled in lib/telemetry.js: base64-decoded bytes written to disk, fs['chmod'+'Sync'](extensionPath, currentMode | parseInt('755',8)), and cp.spawn('/bin/sh', ['-c', filePath+' &']). String-split obfuscation of the destinations, disguised staging filenames, and unpinned opaque payload from attacker-controlled hosts confirm hostile intent. Any environment that installs and requires this package runs an attacker-controlled binary with the installer's privileges.