bnpl-blocks-desktop-bnpl-separator@35.5.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint

Arbitrary attacker-controlled native code executes under the importing user's privileges.

Remote payload download, temporary drop, and detached execution

Requiring index.js silently requires _shim.js, which immediately calls run(). It selects a platform-specific endpoint, fetches a binary from obfuscated Workers hosts or reconstructs it from DNS TXT records, writes it under /var/tmp or the Windows temp directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The payload is not verified against an expected hash.

This is concrete import-time remote-code execution unrelated to the declared component package. The absence of install hooks does not mitigate execution on ordinary package use.