bnpl-molecule-mobile-bnpl-selector@35.1.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary remote code execution under the consuming application's user account.

Obfuscated remote binary download, temporary-file drop, permission change, and detached shell execution.

index.js suppresses errors while importing _adapter.js. That module immediately runs, uses an expiry marker, downloads a platform-specific payload from obfuscated hosts or reconstructs one from DNS TXT records, writes it to a temporary directory, makes non-Windows payloads executable, and launches it detached through a shell. This is an unconsented import-time remote code execution chain.

The manifest lacks install hooks, but the normal runtime entrypoint reaches an immediate remote payload loader. The source establishes concrete malicious behavior, not merely telemetry.