The malicious package bnpl-blocks-independent-bnpl-search (version 20.2.9) includes an index.js file that loads a runtime.js script. This script downloads a platform-specific binary from dynamically assembled *.workers.dev hosts, writes it to temporary directories with disguised names, sets executable permissions on POSIX systems, and spawns the binary detached via shell commands. To evade detection, the destination hostnames are constructed at runtime from split string fragments. If HTTPS fetches fail, the loader falls back to retrieving base64-encoded payload chunks from DNS TXT records under attacker-controlled subdomains of dl.well1.site, reassembling and executing the payload. Additionally, a telemetry.js file contains similar download and execution logic. This behavior constitutes malicious code execution within the npm package.

This malicious code can lead to arbitrary code execution on systems that install and run the affected package version. The attacker can execute platform-specific binaries, potentially leading to system compromise or unauthorized actions. The use of runtime-assembled hostnames and DNS TXT record fallback complicates detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using version 20.2.9 of bnpl-blocks-independent-bnpl-search. Remove the package from affected environments and replace it with a trusted alternative. Monitor for any unusual execution of binaries from temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.