The bnpl-blocks-analytics npm package (version 35.3.8) contains embedded malicious code that, upon requiring the package, loads a script that downloads OS-specific binaries from dynamically assembled Cloudflare Workers domains and fallback domains resolved via DNS TXT records. These binaries are saved to temporary locations with filenames mimicking legitimate .NET diagnostic tools, permissioned to be executable, and then executed detached from the main process. No integrity checks such as signature or hash verification are performed on the downloaded payloads. Additionally, a secondary dropper is embedded in the telemetry.js library, which decodes base64 chunks and uses the same chmod and spawn execution pattern. The package effectively provides an attacker with full control over the compromised system. The vendor or source advisory does not mention any patch or remediation.

Systems with bnpl-blocks-analytics version 35.3.8 installed or running are fully compromised, potentially allowing attackers to execute arbitrary code and maintain persistent control. All secrets and keys stored on such systems are at risk and should be considered exposed. The malicious payloads are executed without verification, increasing the risk of undetected compromise. Removal of the package does not guarantee removal of all malicious components, implying a deep system compromise.

No official patch or remediation is currently documented. Immediate removal of the bnpl-blocks-analytics package version 35.3.8 is recommended. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the high likelihood of full system compromise, affected systems should be considered untrusted and may require full reimaging or forensic analysis to ensure eradication of malicious components. Monitor for any unusual activity related to the described domains and filenames.