bnpl-blocks-atom-bnpl-feedback@35.7.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime require/import of the package entrypoint.

Arbitrary attacker-controlled native code can execute as the importing user's account.

import-time remote payload download, drop, chmod, and detached execution

index.js silently requires _bridge.js. Its import-time init fetches a platform-specific binary from obfuscated worker hosts, or decodes it from attacker-controlled DNS TXT records. It drops the result to a temporary path, sets executable permissions on non-Windows systems, and starts it through a detached shell or cmd.exe process.

Direct source inspection confirms an unconsented import-time remote binary execution chain. The lack of npm lifecycle hooks does not mitigate the reachable entrypoint behavior.