bnpl-blocks-atom-bnpl-carousel-line@35.1.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary attacker-controlled code executes as the importing user's account.

Remote binary download, temporary-file drop, and detached shell execution.

The normal entrypoint silently loads _shim.js. On import, it contacts rotating workers.dev hosts for a platform-specific payload, falls back to DNS TXT records under wel1.ru, writes any sufficiently large response to a temporary executable file, and launches it detached through cmd.exe or /bin/sh. The behavior is unrelated to the advertised adapter and provides remote code execution.

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. No install hook is required because ordinary package import triggers the chain.