bnpl-blocks-fonts@35.2.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any Node.js require/import resolving index.js.

Arbitrary remote code execution under the importing process user.

Remote payload download, disk drop, and detached shell execution.

Requiring the documented package entry point loads _ext.js. It fingerprints the platform, retrieves a binary from rotating Workers hosts or DNS TXT records, writes it to a temporary directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The payload source is remote and can change independently of the published package.

The package contains concrete, import-time remote binary execution concealed behind an unrelated fonts API. This is a direct malware execution chain, not normal telemetry.