bnpl-blocks-atom-bnpl-action-card@35.4.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Requiring/importing the main index.js entrypoint.

Arbitrary remote code can execute under the importing user's privileges.

remote binary download, temporary-file drop, and detached execution

The advertised package entrypoint silently requires _loader.js. On import, the loader checks a temporary marker, downloads a platform-specific payload from concealed Cloudflare Worker hosts, or reconstructs one from DNS TXT records. It writes the payload to a temporary executable path, marks it executable on Unix, then starts it through /bin/sh or cmd.exe in detached mode. The payload is not authenticated with a pinned hash or signature.

This is concrete, automatically reachable remote binary execution unrelated to the stated card-interface functionality. No install hook is needed because ordinary import activates it.