bnpl-blocks-atom-bnpl-anchor-menu@35.8.5

High-risk behavior combination matched malicious policy.

Runtime require/import of index.js.

Unconsented arbitrary code execution on the importing host.

Remote binary download, drop, chmod, and detached execution.

When a consumer requires index.js, it silently requires _loader.js. The loader fetches a platform-specific payload from hard-coded workers.dev hosts, or reconstructs one from DNS TXT records under wel1.ru. If the payload exceeds 1,000 bytes, it is written to a temporary path, made executable on Unix, and launched through a detached shell or cmd.exe process. No payload authenticity check is performed.

This is a concrete import-time arbitrary remote payload execution chain unrelated to the package's advertised minimal SDK API. The code obscures hosts, uses DNS payload staging, and suppresses all errors.