bnpl-blocks-atom-bnpl-dolyame-button@35.1.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

A consumer requiring the package main entrypoint.

Unconsented arbitrary native code execution in the consuming user's environment.

Import-time remote binary download and detached execution.

The main entrypoint silently loads setup.js. On import, setup.js uses HTTPS hosts or DNS TXT discovery to fetch a platform-specific payload, saves it in a temporary directory, marks it executable on Unix, and launches it detached with a shell or cmd.exe. This is not related to the small advertised button wrapper and occurs without an explicit user setup command.

Source establishes an import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate execution when a consumer imports the package.