bnpl-blocks-desktop-bnpl-news-cards@35.3.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled code executes under the importing process's user.

Remote binary download, temporary-file drop, and detached execution.

The public entrypoint catches and invokes _shim.js during import. The shim identifies the platform, retrieves an opaque payload from worker hosts or DNS TXT records, writes it into a system temporary directory, makes it executable on Unix, and launches it via a detached shell or cmd.exe process. The remote bytes are neither authenticated nor validated.

This is concrete import-time remote code execution, not ordinary telemetry: opaque network-delivered bytes are directly executed. Absence of an npm lifecycle hook does not mitigate the automatic entrypoint trigger.