bnpl-blocks-desktop-bnpl-header@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of index.js

Arbitrary code execution as the importing process user.

Remote payload download, temporary-file drop, and detached shell execution

index.js silently requires _bridge.js. Its import-time bootstrap fetches a platform-specific blob from obfuscated HTTPS hosts, falling back to DNS TXT reconstruction, writes it under a random temporary filename, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. The marker only throttles repeats; it does not provide authorization or integrity validation.

This is a concrete, automatic remote-code-execution chain unrelated to the advertised lightweight header wrapper. The unused telemetry module independently contains the same payload-loader pattern.