bnpl-blocks-atom-desktop-bnpl-highlighted-text@35.2.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Requiring/importing the package at runtime.

Remote operator-controlled code executes with the importing process's privileges.

remote payload download or DNS-TXT retrieval followed by detached native execution

At package import, index.js silently loads _platform.js. That module fetches a sufficiently large binary from obfuscated rotating worker hosts, falling back to base64 payload chunks obtained through DNS TXT records. It writes the result under a benign temporary filename, grants execute permission on Unix, and launches it detached through a shell or cmd.exe. The similarly structured telemetry module contains an additional configurable downloader/launcher but is not entrypoint-reachable.

This is concrete import-time remote code execution, not aligned with the advertised highlighted-text module. Lack of lifecycle scripts does not mitigate execution on normal use.