The npm package bnpl-blocks-atom-bnpl-anchor-menu version 35.8.5 includes a malicious loader (_loader.js) that evades static analysis by assembling hostnames from split-string arrays. It downloads an opaque executable from Cloudflare Workers subdomains and fallback domains resolved via DNS-TXT records pointing to Russian infrastructure. The executable is saved to temporary directories under misleading filenames, permissioned to execute, and launched detached from the main process, effectively enabling remote code execution upon package import. A sibling module (lib/telemetry.js) contains similar dropper functionality. This behavior is inconsistent with the package's stated purpose as a UI anchor menu and represents a severe supply chain compromise.

Any system that installs or runs this package version is subject to remote code execution by the malicious payload, resulting in full system compromise. Attackers gain persistent, arbitrary code execution capabilities, potentially accessing all secrets and keys on the host. The compromise is severe enough that removal of the package alone does not guarantee eradication of the attacker presence or malware installed post-compromise.

No official patch or remediation is currently documented. Immediate removal of the bnpl-blocks-atom-bnpl-anchor-menu package version 35.8.5 is strongly advised. Systems with this package installed should be treated as fully compromised; all secrets and keys must be rotated from a separate, trusted environment. Conduct a thorough incident response to identify and remediate any persistent malicious artifacts beyond the package itself. Monitor vendor advisories for any updates or official fixes.