checkout-mobile-bnpl@35.6.9

High-risk behavior combination matched malicious policy.

Requiring/importing the package entrypoint.

Arbitrary native code execution under the importing process user.

remote binary download/DNS staging followed by detached execution

The package entrypoint suppresses errors while importing _helpers.js. That module immediately runs, rate-limits via a temp stamp, obtains a platform payload from rotating worker hosts or DNS TXT records, drops it into a temporary executable file, then launches it detached through a shell. This is an unconsented remote code execution chain.

Source establishes an import-time staged payload download and detached native execution chain; no user action beyond importing the SDK is required. The telemetry-like naming and opt-out checks do not constrain the fetched payload.