checkout-bnpl-logic@35.9.2

High-risk behavior combination matched malicious policy.

Any runtime require/import of checkout-bnpl-logic.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

Remote binary download/DNS staging followed by temporary-file execution.

The public main entrypoint imports _polyfill.js during normal module loading. That code fetches a platform-specific payload from obfuscated CDN hosts or reconstructs one through DNS TXT records, writes it under a temporary randomized filename, makes it executable on Unix, and launches it detached via shell or cmd.exe. This is an unconsented remote-code-execution chain, not a logging feature.

Source inspection confirms concrete import-time download-and-execute behavior. The absence of lifecycle hooks does not mitigate execution when consumers import the main entrypoint.