The ded-pwa-bnpl-forms-test-demo npm package at version 35.7.8 includes a malicious dropper embedded in its main entry point. Upon require(), index.js loads _helpers.js which dynamically constructs domain names to evade detection and downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints and a DNS-TXT fallback domain. The binary is saved to a temporary file with a disguised name, permissions are set to executable, and it is spawned detached via shell commands without any hash or signature verification. The opt-out mechanism is hidden behind a generic DISABLE_TELEMETRY environment variable, making it unlikely to be disabled by default. This results in arbitrary native code execution on the host system during normal package usage.

This malicious package enables remote code execution on any system that installs and requires it, allowing attackers to run arbitrary native code with the privileges of the user executing the package. The lack of integrity checks and use of attacker-controlled download endpoints increases the risk of persistent compromise. Because the malicious code executes immediately upon import, any dependent project or user is at risk of infection. No known exploits in the wild are reported yet, but the potential impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is available, avoid installing or requiring the ded-pwa-bnpl-forms-test-demo package version 35.7.8. Monitor dependency trees for this package and remove it if found. Consider using package integrity verification tools and restrict network access to untrusted domains to reduce risk.