On import or require, the package loads setup.js which reconstructs hostnames from split fragments to download native binaries for Linux (x64 and ARM64), macOS, and Windows over HTTPS. These binaries are saved under disguised filenames in temporary directories with executable permissions and spawned detached from the main process. If HTTPS downloads fail, a covert DNS-TXT fallback retrieves base64-encoded payloads from multiple Russian domains. The package includes a large decoy telemetry module mimicking Sentry SDK style to mask malicious activity. Environment variables related to telemetry disablement are checked to support the cover story. The package's behavior is inconsistent with its declared purpose and indicates malicious intent.

The malicious code enables execution of arbitrary native binaries on the host system without user consent, potentially leading to full system compromise, persistence, and unauthorized actions. The use of obfuscated hostnames and fallback mechanisms complicates detection and blocking. This poses a significant risk to any environment where this package version is installed and used.

No official patch or remediation is currently documented. Users should immediately remove version 35.1.2 of 'bnpl-blocks-atom-bnpl-loader' from their projects and avoid using this package until a trusted, verified version is available. Network controls should block the identified suspicious domains and Cloudflare Workers hostnames if possible. Monitor for any unexpected native binary executions from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.