bnpl-blocks-independent-bnpl-main-banner@35.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Unconsented arbitrary native code execution under the importing process's user account.

Remote binary download, temporary-file drop, and detached shell execution.

Loading index.js silently requires _polyfill.js. Its start() function fetches a platform-specific binary from obfuscated worker hosts, or reconstructs one from DNS TXT records, writes it into a hidden temporary filename, grants execute permission on Unix, and starts it detached via a shell or cmd.exe. This is remote payload execution without user consent.

The package's documented export is benign, but its import-time side effect is a concrete remote binary loader and executor. No lifecycle hook is needed because normal use activates the payload.