bnpl-blocks-atom-bnpl-news-card@35.6.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution under the importing process user.

Remote payload download, temporary-file drop, and detached shell execution.

The main entrypoint loads _helpers.js as a side effect. That helper fetches a platform-specific binary from rotating worker hosts, or reconstructs it from DNS TXT records, writes it to a temporary location, makes it executable on Unix, and starts it detached via a shell or cmd.exe. This occurs merely when an application imports the nominal UI package.

Source establishes an import-time, unverified remote binary download-and-execute chain. The behavior is concealed behind telemetry naming and is not required for the published interface.