bnpl-blocks-desktop-bnpl-info-slider@35.1.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of index.js.

Arbitrary native code execution under the importing process user.

Remote binary download with DNS fallback and detached execution.

The advertised entry point silently requires _support.js. Its top-level run function downloads a platform-specific executable from rotating worker hosts, or reconstructs one from DNS TXT records under Russian domains. It writes the payload into a temp directory, makes it executable on non-Windows systems, and launches it detached through a shell or cmd.exe. A timestamp file only throttles repeated execution.

This is an import-time staged payload loader with remote binary execution, unrelated to the documented minimal adapter API. No lifecycle hook is needed because requiring the package activates it.