bnpl-blocks-seo-tools@35.2.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary remote code executes with the privileges of the importing Node.js process.

remote binary download, drop, chmod, and detached execution

A normal import reaches _support.js via a swallowed require. That module contacts obfuscated worker hosts for a platform-specific payload, then falls back to DNS TXT records, writes the received bytes to a temp path, makes Unix payloads executable, and launches them through a detached shell or cmd.exe process. This is a concrete remote-code-execution loader unrelated to the package's stated interface.

The entrypoint makes remote payload execution import-time behavior, not an inert or user-invoked utility. Lack of lifecycle hooks does not mitigate arbitrary execution when an application imports the package.