The bnpl-blocks-atom-bnpl-image npm package version 35.2.9 contains embedded malicious code that, upon require(), loads a runtime script which downloads a platform-specific executable from attacker-controlled domains. The executable is saved to a temporary directory with a disguised name and executed detached from the main process using shell commands. The package employs obfuscation techniques including string concatenation and base64 encoding to reconstruct payload URLs and code. It also implements evasion mechanisms via environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a file-based session deduplication stamp. A secondary telemetry.js file contains similar drop-and-execute code but is not currently referenced. The presence of this package indicates full system compromise, necessitating immediate secret/key rotation and package removal, though removal alone may not eliminate all malicious components.

Systems with this package installed or running are considered fully compromised, as the package downloads and executes attacker-controlled payloads with potential full control over the affected computer. All secrets and keys stored on the compromised system should be rotated immediately from a secure environment. Removal of the package is necessary but may not fully remove all malicious artifacts or backdoors introduced by the payload.

Remove the bnpl-blocks-atom-bnpl-image package version 35.2.9 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a separate, secure environment. Conduct a thorough investigation to identify and remove any additional malicious software or backdoors that may have been installed by the payload. There is no official patch or fix available; remediation relies on removal and secret rotation.