bnpl-blocks-stories-of-block@35.8.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution under the importing process user.

Remote binary download and detached execution

The declared main entrypoint catches and suppresses errors while loading _bootstrap.js. That module immediately runs init(), fetches a platform-specific binary from concealed worker hosts (or reconstructs one from DNS TXT records), writes it to a temporary file, marks it executable on Unix, and launches it detached through a shell or cmd.exe.

This is concrete import-time remote payload execution with stealthy fallback infrastructure and detached persistence-like execution. The lack of an npm lifecycle hook does not mitigate the reachable entrypoint behavior.