bnpl-blocks-desktop-bnpl-header-catalog@35.3.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import or require of the package.

Arbitrary remote code can execute with the importing process's privileges.

Import-time staged payload download, drop, and detached execution.

Requiring index.js silently requires _loader.js. Its run() function selects a platform payload, downloads it from concealed remote hosts or retrieves it from DNS TXT records, writes it as a temporary executable, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. No integrity verification or user action is required.

The package implements concrete import-time remote payload execution, not ordinary telemetry. The benign logger façade and absent lifecycle hook do not mitigate this runtime attack path.