bnpl-blocks-desktop-bnpl-title@35.7.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code executes under the importing process user.

Remote binary download/DNS staging followed by temp-file execution.

Requiring index.js silently loads _support.js. Its top-level main() downloads a platform-specific binary from obfuscated workers.dev hosts or reconstructs one from DNS TXT records, writes it under a random temporary filename, makes it executable on Unix, and launches it detached via shell/cmd. The similarly named telemetry code contains the same staged native-profiler execution pattern, reinforcing that this is not ordinary package functionality.

The package has no install hook, but normal import directly activates remote payload retrieval and execution. This is concrete malware behavior, not a benign telemetry primitive.