The bnpl-api package (npm ecosystem) version 35.9.5 is a malicious package that masquerades as an empty API stub but on load fetches and executes attacker-controlled native executables. It reconstructs download URLs from obfuscated strings to retrieve binaries from Cloudflare Workers hosts, writes these binaries to temporary directories under disguised names, sets executable permissions, and spawns them detached using shell commands. If HTTPS retrieval fails, it uses a DNS-TXT record covert channel to reassemble a base64-encoded binary and execute it similarly. The package also uses dynamic require calls to evade static detection. It provides no legitimate functionality and compromises any system where it is installed.

Any system with this package installed is considered fully compromised, as the package runs opaque attacker-controlled binaries with the privileges of the installer. This can lead to complete system takeover, theft of secrets and keys, and persistent malicious presence. Removal of the package alone does not guarantee eradication of the attacker’s foothold.

Immediate removal of the bnpl-api package version 35.9.5 is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted system. Because the package executes arbitrary native code, assume full compromise and consider rebuilding the affected system. No official patch or fix is available; avoid using this package version entirely.