bnpl-blocks-desktop-bnpl-shopping-header@35.5.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary remote code execution in the importing user's environment.

Remote payload download, temporary-file staging, and detached execution.

At import time, index.js silently loads _loader.js. The loader selects a platform-specific payload path, fetches a binary from rotating workers.dev hosts or reconstructs one from DNS TXT records, stores it in a temporary directory, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. A temporary marker limits repeated attempts while errors and output are suppressed.

This is a concrete import-triggered remote-code-execution chain unrelated to the declared library functionality. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.