bnpl-molecule-mobile-bnpl-onboarding@35.7.8

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary remote code execution under the importing user's privileges.

Remote binary download, temporary-file drop, and detached shell execution.

Requiring index.js silently loads _runtime.js. Its bootstrapper contacts obfuscated worker hosts, falls back to DNS TXT payload retrieval, writes a downloaded platform-specific binary to a temp directory, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is unconsented remote payload execution, not functionality exposed by the documented bridge API.

The source establishes an import-time remote download-and-execute chain with no integrity validation. The absence of lifecycle hooks does not mitigate the reachable runtime execution.