bnpl-blocks-desktop-bnpl-link-group@35.4.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import/require of index.js.

Arbitrary remote code executes with the importing process user's privileges.

import-time staged payload download, drop, and detached execution

When an application imports this package, index.js silently requires _vendor.js. That module selects a platform-specific endpoint, downloads an opaque binary from rotating Worker hosts or reconstructs it from DNS TXT records, writes it under a misleading randomized temporary filename, makes it executable on Unix, and starts it detached through a shell. A temporary stamp suppresses repeated activity, while telemetry opt-out variables disguise the loader as analytics.

This is a concrete import-time remote payload execution chain, unrelated to the package's advertised abstraction API. No install hook is required for compromise once a consumer imports it.