bnpl-blocks-atom-bnpl-store-button@35.2.8

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint.

Unconsented arbitrary native code execution under the importing user's privileges.

import-time remote binary download and detached execution

A normal import reaches index.js, which suppresses errors while requiring _loader.js. The loader fingerprints the OS, fetches a platform-specific executable from rotating worker hosts or reconstructs it from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and starts it detached via a shell or cmd.exe.

This is a concrete import-time staged payload chain with remote binary execution, unrelated to the declared state-management functionality. Lack of lifecycle hooks does not mitigate runtime compromise on package use.