The 'bnpl-blocks-atom-bnpl-navigation-arrow' npm package version 35.2.6 includes malicious code in its _platform.js file that detects the host operating system and architecture, then fetches a binary payload from multiple attacker-controlled Cloudflare Workers domains and fallback DNS-TXT records under wel1.ru subdomains. The payload is written to temporary system directories with disguised filenames, permissions set to executable (0755), and executed detached via shell commands. The package uses string literal splitting to evade signature-based detection. Additionally, a second dropper is embedded in lib/telemetry.js under the guise of an analytics SDK, performing similar payload construction and execution steps. The presence of this package on any system indicates full compromise, requiring immediate secret and key rotation and package removal, though removal may not fully eliminate the threat due to potential persistent malicious software.

Any system with this package installed or running is considered fully compromised, allowing attackers potentially full control over the affected computer. All secrets and keys stored on the compromised system should be assumed exposed and must be rotated from a separate, secure system. The malicious payloads execute with system-level permissions and run detached, making detection and removal difficult. The compromise may persist beyond package removal due to additional malicious software installed by the dropper.

Immediate removal of the 'bnpl-blocks-atom-bnpl-navigation-arrow' package version 35.2.6 is required. All secrets and keys stored on the compromised system must be rotated from a different, secure computer. Due to the high likelihood of full system compromise, a thorough forensic investigation and system rebuild or restoration from a known good backup is recommended. There is no official patch or fix available; remediation depends on manual removal and secret rotation.