The malicious npm package bnpl-blocks-atom-bnpl-info-card (version 35.7.3) auto-loads a script that reconstructs obfuscated domain names to communicate with Cloudflare Workers subdomains and other domains. It uses a DNS-TXT record covert channel to retrieve a base64-encoded binary payload in chunks, which it reassembles and writes to temporary files with innocuous names. The payload is made executable and launched in a detached shell process, enabling remote code execution. A second bundled module performs a parallel backup dropper function with the same technique. This results in full host compromise upon installation or requiring the package.

Full remote code execution on any system that installs or requires this package, leading to complete compromise. Attackers gain persistent control and can execute arbitrary code, potentially stealing secrets and keys. The system should be considered fully compromised, and secrets must be rotated from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts.

Immediate removal of the package is recommended. However, because the package enables full host compromise, all secrets and keys stored on the affected system should be rotated from a different, uncompromised machine. Incident response should assume full system compromise and consider rebuilding the affected environment. No official patch or fix is available; remediation depends on removal and secret rotation.