The bnpl-blocks-atom-bnpl-button npm package version 35.4.7 includes a malicious runtime component (_runtime.js) that downloads a platform-specific executable from obfuscated hosts under oob-worker.cf10x-*.workers.dev and writes it to temporary directories with disguised filenames. The executable is made executable and spawned detached via shell commands. If the HTTPS fetch fails, a fallback mechanism reconstructs the binary from base64-decoded DNS TXT records from *.dl.wel1.ru, enabling covert retrieval to evade network inspection. Hostnames and API calls are dynamically constructed at runtime to evade static detection. This dropper activates immediately upon requiring the package, leading to full system compromise and potential exfiltration of secrets and keys.

Any system with this package installed or running is considered fully compromised. The attacker may have full control over the system, including access to all stored secrets and keys. Removal of the package alone does not guarantee eradication of the malicious software or attacker persistence. Immediate rotation of all secrets and keys from a separate, trusted system is necessary.

Remove the bnpl-blocks-atom-bnpl-button package version 35.4.7 immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted machine. Because the attacker may have persistent control, consider full system reimaging or forensic analysis. There is no official patch or fix available; the package should be considered untrusted and avoided.