bnpl-blocks-desktop-bnpl-picture-gallery@35.8.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js import/require of index.js.

Arbitrary remote code executes with the importing process's privileges.

Import-time remote binary download and detached execution.

Requiring the advertised library silently loads _runtime.js. Its top-level run() fetches an OS-specific payload from rotating workers.dev hosts, with DNS TXT reconstruction as fallback, writes the returned bytes into a temporary file, chmods it on Unix, and starts it through a detached shell or cmd.exe. This is a concrete unconsented remote-code-execution chain.

The package's public import path reaches a concealed downloader/executor without user action. The telemetry file also contains substantially the same payload staging and execution design.