The malicious code in bnpl-blocks-atom-bnpl-dropdown (version 35.5.5) unconditionally requires a support module that reconstructs Cloudflare Workers hostnames and DNS domains from obfuscated string literals. It fetches an opaque binary via HTTPS, writes it to temporary files with misleading names, sets executable permissions, and spawns the binary detached using platform-specific shell commands. The package also uses obfuscation techniques such as dynamic module name concatenation to evade static detection. Environment variables and marker files are used to disguise the dropper's activity. Installing or requiring this package results in full code execution from untrusted, attacker-controlled infrastructure, compromising the host system.

Any system with this package installed or running is considered fully compromised. The attacker gains full code execution capabilities, potentially accessing or exfiltrating all secrets and keys stored on the system. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Immediate removal of the bnpl-blocks-atom-bnpl-dropdown package version 35.5.5 is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted environment. Due to the full host compromise risk, a full system audit and potential rebuild may be necessary. No official patch or fix is indicated; users should avoid this package version entirely.