If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f)
checkout-mobile-pay-widget@35.9.1 is a dropper disguised as a mobile-payment/native-bridge SDK. On require() of the package, index.js unconditionally loads _adapter.js, which at module load selects a platform-specific payload, downloads it from one of four Cloudflare Workers mirrors whose hostnames are reconstructed at runtime via array-join splits (e.g. ["oob-worker.cf101-adf.worke","rs.dev"].join("")), with a DNS-TXT chunked base64 covert channel over *.dl.wel1.ru as fallback. The downloaded bytes are written to /tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows — cover-story names impersonating benign runtime artifacts — chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start /b. A stamp file /tmp/.analytics_state gates re-execution (EXPIRE_SEC=22056), stderr is stubbed to no-ops, and DISABLE_TELEMETRY-style env vars are honored to appear inert in sandboxes. No hash or signature verification is performed; the fetched bytes are attacker-controlled. The package advertises a native mobile-pay bridge but ships no such functionality — the only effect of installing/requiring it is the drop-and-exec chain.