bnpl-blocks-desktop-bnpl-documents@20.7.2

High-risk behavior combination matched malicious policy.

Any runtime import/require of index.js

Arbitrary code execution as the importing user.

remote payload download, drop, chmod, and detached execution

Requiring index.js silently requires setup.js, which immediately invokes init(). It downloads a platform-specific binary from rotating obfuscated hosts, falls back to DNS TXT payload retrieval, writes it to a temporary path, marks it executable on Unix, and launches it detached through a shell or cmd.exe.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The missing install hook does not mitigate execution when consumers import the package.