bnpl-blocks-shops-api@35.2.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of index.js.

Arbitrary native code execution with the importing process user's permissions.

Remote payload download, temporary-file staging, and detached shell execution.

Requiring the advertised SDK loads setup.js without user action. That module retrieves a platform-specific opaque payload from rotating HTTPS endpoints or DNS TXT records, stores it under a disguised temporary filename, applies execute permission on Unix, and launches it through a detached shell or cmd.exe process. The long telemetry module contains a parallel configurable implementation of this loader.

The package has no legitimate SDK functionality beyond a minimal class, while import-time code performs covert remote binary staging and execution. This is a concrete arbitrary-code-execution chain.