The malicious code in [email protected] uses an asynchronous bootstrap in _polyfill.js to reconstruct network destinations from obfuscated string fragments, then downloads a binary payload from Cloudflare Workers hosts and fallback domains. It writes the payload to a temporary file, sets executable permissions, and spawns it detached via a shell command. Additionally, lib/telemetry.js contains dormant code with the same drop-and-execute pattern, though it is not currently reachable from the main entry point. The obfuscation of child_process import and hostnames serves as evasion against static detection. No integrity checks or version pinning are present, increasing risk.

This malicious package can execute arbitrary code on the host system by downloading and running an external binary payload without user consent or verification. This can lead to compromise of the host environment, unauthorized access, or further malware deployment. The presence of dormant similar code suggests potential for additional malicious functionality. There are no known exploits in the wild reported yet, but the capability for remote code execution is significant.

No official patch or remediation is currently available for this package version. Users should immediately avoid using bnpl-blocks-atom-bnpl-checkbox version 35.6.1 and remove it from their environments. Consider auditing dependencies for malicious code and replacing this package with a trusted alternative. Monitor for updates from the package maintainer or npm advisories for any future fixes. Since this is not a cloud service, remediation depends on user action.