The 'checkout-desktop-bnpl' npm package version 35.5.1 exports an empty class with no legitimate functionality. When the main module is required, it loads a polyfill script that selects a platform-specific remote endpoint hosted on Cloudflare Workers. It downloads a binary payload via obfuscated DNS-over-TXT fallback channels from attacker-controlled domains, base64-decodes and reassembles the payload, writes it to temporary storage with decoy filenames, sets executable permissions on Unix systems, and executes it detached via shell commands. There is no hash or signature verification of the payload, and the delivery hosts are unpinned and fully attacker-controlled. This behavior triggers arbitrary remote code execution on any system importing the package.

Any process that imports the affected version (35.5.1) of the 'checkout-desktop-bnpl' package will execute attacker-controlled code with the privileges of the importing process. This can lead to full system compromise, data theft, persistence, or further malicious activity. The lack of integrity checks and use of attacker-controlled delivery infrastructure makes this a high-risk supply chain compromise.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.5.1 of the 'checkout-desktop-bnpl' package. Verify the authenticity of packages before installation and consider using trusted package registries or mirrors. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance. Until a fix is available, do not import or require this package in any environment.