The npm package bpm-renovate-renovate-config version 35.9.2 contains malicious code that acts as a supply-chain dropper. Upon requiring the package, it downloads a platform-specific binary from obfuscated worker.dev domains or a DNS TXT record fallback, writes it to temporary directories under decoy names, sets executable permissions, and executes it detached from the main process. This behavior allows arbitrary attacker-controlled native code execution on any host that installs or requires this package.