The 'bnpl-blocks-atom-bnpl-feedback' npm package version 35.7.5 includes a malicious component in its _bridge.js file that dynamically reconstructs obfuscated hostnames to download unsigned binaries over HTTPS from Cloudflare Workers subdomains, with a base64-over-DNS-TXT fallback mechanism. These binaries are saved to temporary directories under disguised filenames, permissions are set to executable, and they are spawned detached via shell commands. The package's public interface exports a trivial no-op class, concealing this malicious network dropper behavior. The compromise is severe enough that any system with this package installed should be considered fully compromised.

Systems with this package installed are at risk of full compromise due to the execution of unsigned, remotely downloaded binaries. Attackers may gain complete control over the affected computer, potentially accessing all stored secrets and keys. Removal of the package alone does not guarantee eradication of the malicious payload or persistence mechanisms.

Immediate removal of the 'bnpl-blocks-atom-bnpl-feedback' package version 35.7.5 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted device. Due to the high likelihood of full system compromise, a thorough incident response including system reimaging or restoration from a known good backup is advised. Patch status is not confirmed; no official fix or patch is currently available. Monitor vendor advisories for updates.