bnpl-blocks-mobile-bnpl-info-slider@35.8.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package's index.js entrypoint.

Arbitrary native code executes under the importing process user's privileges.

silent remote binary download, drop, chmod, and detached execution

The public main entrypoint catches and suppresses errors while importing setup.js. That module contacts obfuscated remote hosts for an OS-specific binary, falls back to DNS TXT payload reconstruction, stores the result under an inconspicuous temporary filename, marks it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain triggered merely by importing the package.

Source inspection confirms an import-time remote payload download-and-execute chain unrelated to the declared mobile SDK function. The lack of npm lifecycle hooks does not mitigate the reachable import-time execution.