bnpl-blocks-atom-bnpl-notification@35.3.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js.

Unconsented remote code execution as the importing user's account.

Remote payload download, DNS fallback, temporary binary drop, and detached execution.

index.js suppresses errors while importing _runtime.js. That module executes setup immediately, retrieves a platform payload from obfuscated HTTPS mirrors or DNS TXT records, writes it to a temporary executable path, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. This provides the package author remote code execution whenever the package is imported.

The import-time remote binary loader and detached execution are concrete malicious behavior, not ordinary telemetry. No lifecycle hook is needed because the package entrypoint triggers the payload chain.