The npm package bnpl-blocks-atom-bnpl-base-popup version 35.2.9 is malicious. Its main entry point requires a _polyfill.js script that dynamically reconstructs Cloudflare Workers hostnames to download a platform-specific native binary. This binary is saved to temporary locations with executable permissions and launched detached from the main process. A secondary file, lib/telemetry.js, duplicates this behavior under the guise of an Analytics SDK. The package uses environment variables and a TTL marker file to evade detection in sandbox or research environments. Importing this package triggers automatic download and execution of potentially harmful code, leading to full system compromise.

Any system with this package installed or running is considered fully compromised. The malicious binary grants the attacker full control over the host, risking exposure of all stored secrets and keys. Immediate rotation of all credentials accessed from the compromised system is necessary. Removal of the package alone does not guarantee elimination of all malicious components or persistence mechanisms.

Remove the bnpl-blocks-atom-bnpl-base-popup package version 35.2.9 immediately from all affected systems. Rotate all secrets and keys that were stored or used on the compromised machines, performing these actions from a separate, trusted environment. Because the package executes an opaque binary that may establish persistence, conduct a thorough forensic investigation and system cleanup to ensure no residual malicious components remain. No official patch or fix is available; the package itself is malicious and should not be used.