The malicious npm package bnpl-blocks-atom-bnpl-image-popup (version 35.9.6) contains code in _compat.js that reconstructs command and control (C2) hostnames to download an opaque binary payload from attacker-controlled domains (*.workers.dev and *.dl.wel1.ru). The payload is saved to temporary directories under disguised filenames, permissioned for execution, and launched detached from the main process. A fallback mechanism retrieves the payload via DNS TXT records encoded in base64. Execution is gated by marker files and environment variables to evade detection and telemetry. This results in full compromise of any system running this package.

Systems with this package installed are fully compromised, as the malicious code downloads and executes arbitrary binaries controlled by attackers. This can lead to complete loss of confidentiality, integrity, and availability. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation from a secure environment. Removal of the package alone does not guarantee eradication of the malware or attacker persistence.

Immediate removal of the malicious package bnpl-blocks-atom-bnpl-image-popup version 35.9.6 is required. All secrets and credentials on affected systems must be rotated from a different, trusted machine. Due to the nature of the compromise, a full system forensic analysis and potential rebuild is recommended to ensure complete eradication. There is no official patch or fix available; remediation relies on removal and credential rotation.