bnpl-blocks-desktop-bnpl-footer@35.2.6

High-risk behavior combination matched malicious policy.

Runtime import/require of index.js

Arbitrary attacker-controlled native code executes as the importing process user.

remote binary download, DNS fallback, temporary-file drop, detached execution

At import time, index.js loads _bridge.js. The bridge fetches a platform-specific binary from obfuscated worker hosts, or reconstructs one through DNS TXT records, drops it into a system temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. Errors are suppressed and a temporary timestamp file limits repeat execution.

This is a concrete import-triggered remote payload execution chain unrelated to the advertised UI package. Lack of lifecycle hooks does not mitigate the malicious runtime side effect.