bnpl-blocks-atom-bnpl-base-popup@35.2.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint, unless telemetry opt-out environment variables are set.

Arbitrary remote code execution as the importing process user.

Remote binary download, DNS fallback, temp-file drop, and detached shell execution.

The package entrypoint silently loads _polyfill.js. On import, it retrieves a platform-specific payload from obfuscated worker hosts or DNS TXT records, drops it in temporary storage, marks it executable on Unix, and starts it through a detached shell or cmd.exe. This is a concrete remote-code-execution chain with no user invocation or payload verification.

Direct source inspection confirms import-time remote payload download and execution. The benign-looking public API and absence of lifecycle hooks do not mitigate this reachable malicious behavior.