bnpl-blocks-mobile-bnpl-floating-button@35.3.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary native code execution under the importing process user.

remote binary download, drop, and detached execution

A normal import reaches _support.js, which rate-limits itself with a temp marker, retrieves a platform-specific binary from obfuscated Workers hosts or DNS TXT records, writes it to a temp path, makes Unix payloads executable, and starts them detached via /bin/sh or cmd.exe. This is a concrete remote code-execution chain, not package-aligned SDK behavior.

The import-time remote payload execution chain is explicit in source and requires no user setup action. The unused-looking telemetry module does not mitigate this behavior.