The npm package bnpl-blocks-atom-bnpl-news-card (version 35.6.8) includes a malicious _helpers.js script that dynamically constructs destination hostnames to evade static detection and downloads an opaque binary payload from obfuscated Cloudflare Workers hosts and DNS-TXT fallback domains under wel1.ru subdomains. The payload is written to temporary directories (/var/tmp or %TEMP%) under disguised filenames, permissioned as executable (0755), and spawned detached via shell commands. A marker file prevents repeated execution. This behavior is inconsistent with the package's legitimate function as a UI news card, indicating malicious intent. The compromise allows full control of the infected system by an external attacker.

Any system with this package installed or running is considered fully compromised. The attacker may have gained full control over the system, potentially accessing all stored secrets and keys. Immediate secret and key rotation from a separate, trusted system is required. Removing the package alone does not guarantee removal of all malicious components or backdoors introduced by the payload execution.

Remove the bnpl-blocks-atom-bnpl-news-card package version 35.6.8 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems using a different, secure environment. Because the package executes a native binary that may establish persistent control, assume full system compromise and consider rebuilding or thoroughly cleaning affected hosts. There is no official patch or fix available; remediation requires removal and secret rotation.