bnpl-blocks-scroll@35.2.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of bnpl-blocks-scroll.

Arbitrary attacker-controlled code execution under the importing process user.

remote binary download, drop, and detached execution

On package import, index.js requires _helpers.js. Its top-level main routine downloads a platform-specific payload from obfuscated Workers hosts, or reconstructs one from DNS TXT records, writes it to a temp path, makes it executable on Unix, and launches it via a detached shell or cmd.exe process. The same loader design appears in the unreferenced telemetry module.

This is concrete import-time remote code execution, not legitimate telemetry: no payload authenticity check is enforced and the downloaded binary is executed detached. Block publication.