The 'checkout-mobile-bnpl' npm package version 35.6.9 includes embedded malicious functionality. On load, it reconstructs multiple Cloudflare Workers hostnames from split strings and uses DNS-TXT record lookups from several domains to retrieve base64-encoded chunks. These chunks are reassembled into platform-specific binaries for Linux (x64 and ARM64), macOS, and Windows. The binaries are saved to temporary directories with disguised filenames, permissions are set to executable (0755), and they are spawned detached via shell commands. A secondary payload with similar dropper techniques exists in a telemetry module but is not invoked in this version. The package falsely presents itself as BNPL-related tooling while connecting to unrelated external infrastructure.

The malicious package can execute arbitrary platform-specific binaries on affected systems, potentially leading to full system compromise or unauthorized actions. The use of DNS-TXT fallback channels and multiple external hosts complicates detection and blocking. The disguised binaries and detached execution increase stealth. There is no indication of active exploitation in the wild yet, but the capability for remote code execution and persistence is present.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove version 35.6.9 of 'checkout-mobile-bnpl' from their environments and avoid installing this package. Employ supply chain security measures such as verifying package provenance and integrity before installation. Monitor for any suspicious processes or network activity related to the described domains and binaries. Patch status is not yet confirmed — check vendor or repository advisories for updates.