bnpl-blocks-component-story-name@35.2.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js, unless opt-out environment variables are set.

Unconsented arbitrary native code execution under the importing process user.

Import-time remote binary download and detached execution.

The public entrypoint silently loads _polyfill.js. Its start() function runs immediately, retrieves a binary from obfuscated worker hosts or DNS TXT records, saves it under a temporary cache-like filename, makes it executable on Unix, then launches it detached through a shell or cmd.exe.

This is a concrete import-time remote payload execution chain unrelated to the advertised SDK. The absence of install hooks does not mitigate execution when an application imports the package.