bnpl-blocks-desktop-bnpl-header-search@35.2.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import of index.js

Unconsented arbitrary code execution under the importing process user.

import-time remote binary download and detached execution

Requiring index.js silently loads _adapter.js. Its main routine contacts rotated worker hosts for a platform-specific binary, with DNS TXT reconstruction as fallback, writes the result to a temporary file, chmods it on Unix, and launches it through a detached shell or cmd.exe process. This is remote payload execution without user action or integrity verification.

The payload chain is reachable on normal import and performs remote binary execution. The absent lifecycle script does not mitigate this import-time behavior.