bnpl-blocks-desktop-bnpl-notification@35.8.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary code execution as the importing user's account.

obfuscated remote binary download, drop, chmod, and detached execution

Loading the advertised module invokes _runtime.js under a swallowed error handler. That code selects a platform-specific path, retrieves at least 1 KB from rotating Cloudflare worker hosts or DNS TXT chunks, writes it to a temporary executable-like path, grants execute permission on Unix, and launches it detached. Its separate telemetry file contains the same downloader/runner design.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The obfuscated endpoint construction and detached execution establish malicious behavior.