The npm package bnpl-blocks-atom-bnpl-action-card version 35.4.7 contains embedded malicious code that dynamically constructs obfuscated URLs to download a binary payload from multiple Cloudflare Workers hosts and fallback domains. This payload is written to temporary directories under disguised filenames, permissions are set to executable, and it is spawned detached via shell commands. The package also drops a marker file and includes a secondary dropper script performing similar actions. The downloaded binary is opaque, unsigned, and not tied to the package version, indicating potential for arbitrary code execution and full system compromise. The malicious behavior is designed to evade static detection by constructing identifiers at runtime and using chunked-base64 DNS-TXT fallback mechanisms.

Systems with this package installed or running are considered fully compromised. The attacker may have full control over the affected computer, including access to all stored secrets and keys. This level of compromise necessitates immediate rotation of all credentials from a separate, trusted system. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the payload.

No official patch or fix is currently available. Immediate removal of the package is recommended. All secrets and keys stored on the compromised system should be rotated immediately from a different, secure computer. Due to the potential for persistent compromise, a full system rebuild or forensic analysis is advised to ensure complete remediation.