The malicious npm package bnpl-blocks-atom-bnpl-breadcrumbs (version 35.8.2) loads a polyfill script that fetches an opaque binary payload from obfuscated Cloudflare Workers subdomains or, if HTTPS fails, reconstructs it from base64-encoded DNS TXT records. The payload is saved to temporary directories under disguised filenames and executed asynchronously, allowing it to persist beyond the initial require() call. The C2 hostnames are dynamically constructed at runtime to evade static detection. The package respects DO_NOT_TRACK and DISABLE_TELEMETRY environment variables to evade analysis. No cryptographic verification of the downloaded binary is performed, increasing risk. A hidden marker file tracks prior execution. The presence of this package indicates full system compromise, with potential unauthorized control and data exposure.

Any system with this package installed or running is considered fully compromised. The malicious code executes arbitrary binaries fetched from attacker-controlled infrastructure, potentially allowing complete system takeover. All secrets and keys stored on the compromised machine are at risk and should be rotated immediately from a secure, unaffected device. Removing the package alone may not eliminate all malicious artifacts or backdoors installed by the payload.

Immediate removal of the bnpl-blocks-atom-bnpl-breadcrumbs package version 35.8.2 is recommended. All secrets and credentials stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild may be necessary. No official patch or fix is available for this malicious package. Monitor for any signs of persistence or additional malicious activity.