The npm package bnpl-blocks-independent-bnpl-search version 20.2.9 contains malicious code that downloads and executes platform-specific binaries from attacker-controlled domains. The malicious loader evades static URL detection by assembling hostnames at runtime and uses fallback techniques involving DNS TXT records to retrieve payloads. This behavior enables execution of arbitrary code on the host system.