bnpl-blocks-desktop-bnpl-floating-button@35.7.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary remote code execution under the importing user's privileges.

remote payload download, temp-file drop, and detached execution

Requiring the package runs _helpers.js. Unless telemetry-related environment variables are set or a short-lived marker exists, it downloads a platform-specific binary from obfuscated worker hosts or DNS TXT records, writes it to a temporary directory, makes non-Windows payloads executable, and launches it detached through /bin/sh or cmd.exe.

This is a concealed import-time remote binary downloader and executor, unrelated to the declared floating-button library purpose. The absence of an npm lifecycle hook does not mitigate the reachable runtime RCE.