The 'bnpl-blocks-atom-bnpl-email-form' npm package version 35.3.9 includes malicious code that triggers automatically upon requiring or importing the package. It downloads a binary payload from one of four obfuscated Cloudflare Workers endpoints or reconstructs it via a DNS-TXT covert channel under the domain '*.dl.wel1.ru'. The binary is saved to temporary directories on POSIX or Windows systems with misleading filenames and permissions, then executed detached from the main process. A second dropper implementation within 'lib/telemetry.js' uses string-split obfuscation to evade static analysis and performs the same fetch-write-execute chain. This behavior occurs without user consent, version pinning, or integrity verification, effectively granting full control of the compromised system to an attacker.

Systems with this package installed or running are considered fully compromised. The attacker gains the ability to execute arbitrary code with the privileges of the running process. All secrets, keys, and sensitive data stored on the compromised system may be exposed or stolen. Removal of the package alone does not guarantee eradication of the malicious software or attacker persistence.

Immediate removal of the 'bnpl-blocks-atom-bnpl-email-form' package version 35.3.9 is required. All secrets and keys stored on affected systems should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a thorough incident response including forensic analysis and system restoration is recommended. No official patch or fix is currently available; users should avoid this package version entirely.