bnpl-blocks-mobile-bnpl-header@35.2.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of the package main entrypoint.

Arbitrary remote code executes with the privileges of the importing process.

Import-time download, temporary-file drop, chmod, and detached shell execution.

The main entrypoint silently requires _bridge.js. On import, it fetches a platform-specific payload from obfuscated remote hosts, or reconstructs one from DNS TXT records, writes it to a temporary file, makes it executable on non-Windows systems, and starts it detached through a shell or cmd.exe. This is unauthenticated import-time remote code execution.

Source inspection confirms a concrete hidden payload download-and-execute chain reachable through the normal import path. The lack of lifecycle hooks does not mitigate the import-time execution.