bnpl-blocks-mobile-bnpl-card-gallery@35.4.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package main entrypoint.

Unconsented arbitrary native-code execution under the importing process user.

Remote binary download, drop, chmod, and detached execution.

Requiring index.js silently requires _vendor.js. Its start routine contacts obfuscated workers.dev mirrors for a platform-specific executable, falls back to chunked DNS TXT retrieval, writes the received bytes into a temp file, marks non-Windows files executable, and starts the file through a detached shell or cmd.exe process. The similarly structured telemetry file contains the same loader capability but is not needed for the reachable attack chain.

The package’s import path performs an unconsented download-and-execute chain with obfuscated infrastructure and no validation. The absence of npm lifecycle hooks does not mitigate execution on normal runtime import.