bnpl-blocks-utils@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary native code execution as the importing process user.

Remote payload download, drop, and detached execution.

The public entrypoint suppresses errors while loading _loader.js. On import, it rate-limits via a temporary stamp, retrieves a platform-specific binary from disguised CDN hosts or DNS TXT chunks, writes it into a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The telemetry file contains matching payload-loader functionality, reinforcing that this is deliberate rather than a utility feature.

This package claims only helper methods, yet its import path implements a concealed remote binary loader and executor. The behavior creates a direct arbitrary-code-execution chain without user consent.