The malicious npm package [email protected] loads an obfuscated script (_ext.js) that reconstructs hardcoded hostnames and downloads a platform-specific binary from untrusted, author-controlled servers. It writes the binary to a temporary disguised filename, sets executable permissions, and spawns it detached using shell commands on Unix or Windows. The package uses string concatenation to hide usage of child_process and does not perform any hash or signature verification on the downloaded binary. The package masquerades as telemetry/session tracking but functions as a staged binary dropper, resulting in full system compromise.

Any computer with this package installed or running should be considered fully compromised. The malicious binary execution grants attackers full control over the system, risking exposure of all secrets and keys stored on the machine. Removal of the package alone does not guarantee eradication of the malware, as the attacker may have established persistence or additional malicious components.

Immediate removal of the bnpl-blocks-atom-bnpl-integrations-breadcrumbs package version 35.2.9 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a thorough incident response including forensic analysis and system rebuild is advised. No official patch or fix is available; remediation relies on removal and secret rotation.