checkout-mobile-pay-button@20.8.3

Analysis

checkout-mobile-pay-button@20.8.3 is a trojanized package that downloads and executes a second-stage binary on the installer's machine. When required (require("./_loader") at the bottom of index.js), it contacts Cloudflare Workers endpoints (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev) via HTTPS GET to /pkg/package (or platform-specific paths /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). It also uses DNS TXT record lookups on c[.]tin[.]dl[.]well1[.]site as a fallback channel. The downloaded binary is written to /var/tmp/.cache_<random> (or %TEMP%\dotnet_diag_<random>.exe on Windows), made executable, and spawned as a detached background process via /bin/sh or cmd.exe. The package has no repository, no README, and no lifecycle scripts — the payload runs on require().