The ded-pwa-bnpl-forms-demo package (version 35.9.6) includes code in its index.js that loads a support script executing immediately upon import. This script dynamically constructs hostnames to download a binary payload over HTTPS from Cloudflare Workers or alternatively retrieves base64-encoded payload chunks via DNS TXT records from *.dl.wel1.ru subdomains. The payload is decoded, saved to temporary filesystem locations with disguised filenames, permissions set (chmod 0755 on POSIX), and executed detached from the main process. The dropper uses marker files to avoid repeated execution and is disguised under telemetry-related naming conventions. No cryptographic verification of the downloaded payload is performed, and the payload sources are unrelated to the package's stated purpose, indicating malicious intent.

This malicious package can execute arbitrary binary code on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The lack of payload integrity checks and use of dynamic, obfuscated download methods increase the risk of undetected malicious activity. Since the payload runs detached and suppresses re-execution, it can persist stealthily.

No official patch or remediation is currently documented for this package version. Users should avoid using ded-pwa-bnpl-forms-demo version 35.9.6 and remove it from their environments. Verify dependencies and source integrity before installation. Monitor for updates or advisories from the package maintainers or security vendors regarding this threat. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.