bnpl-blocks-atom-bnpl-product-card@35.6.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

require/import of the package main entrypoint

Arbitrary code execution under the importing user's privileges.

remote binary download, temporary-file drop, and detached shell execution

The published entrypoint catches and hides a require of _bootstrap.js. On import, the bootstrap fingerprints the platform, downloads a platform-specific payload from rotating Workers hosts or reconstructs one from DNS TXT records, writes it to a temp directory, changes permissions on Unix, and launches it detached through a shell or cmd.exe. The payload is not integrity-checked or user-invoked.

This is concrete import-time remote payload execution, not legitimate telemetry. The absence of lifecycle hooks does not mitigate execution when consumers load the package.