bnpl-blocks-desktop-bnpl-feedback@35.3.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented remote code execution as the importing user's OS account.

remote binary download, drop, chmod, and detached execution

When the package is imported, index.js silently loads _init.js. That module selects a platform-specific endpoint, retrieves a binary from rotating Worker hosts or DNS TXT records, drops it to a temporary directory, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. It does not authenticate the downloaded payload.

The package's normal import path contains a concealed, unauthenticated remote payload execution chain unrelated to its stated data-mapper/persistence-adapter purpose. This is concrete malware behavior.