bnpl-blocks-types-gen@35.4.4

High-risk behavior combination matched malicious policy.

Any runtime require/import of bnpl-blocks-types-gen

Arbitrary native code execution under the importing process user.

Remote payload download, DNS fallback, temp-file drop, and detached process execution

The public entrypoint silently imports _platform.js. That module immediately downloads a platform-specific payload from obfuscated worker hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is concrete import-time remote code execution disguised as telemetry.

The package’s only public entrypoint executes a concealed remote payload chain with no user action beyond importing it. No legitimate wrapper functionality explains binary retrieval and detached execution.