The 'bnpl-blocks-desktop-bnpl-anchor-title' npm package version 35.2.5 includes a malicious '_bootstrap.js' script that, upon require(), downloads a platform-specific binary from author-controlled Cloudflare Workers and fallback hosts under dl.wel1.ru. The binary is assembled at runtime from split string fragments to evade detection, fetched unpinned and unverified, saved to a temporary path, permissions set to executable, and then executed detached via shell commands. The package also contains 'lib/telemetry.js' with similar dropper functionality. This behavior effectively gives the attacker full control over the compromised system. The package's analytics/telemetry claims are a cover for this malicious activity.

Systems with this package installed or running are considered fully compromised. The attacker gains the ability to execute arbitrary code via the downloaded binary, potentially leading to complete system takeover. Any secrets, keys, or sensitive data stored on the compromised system may be exposed or stolen. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms installed by the attacker.

Immediate removal of the 'bnpl-blocks-desktop-bnpl-anchor-title' package version 35.2.5 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a full system forensic analysis and potential rebuild is advised. There is no known patch or fixed version available; users should avoid this package entirely.