The npm package 'checkout-bnpl-logic' version 35.9.2 contains malicious code that executes an attacker-controlled binary on the host system upon import. The package exports a decoy Logger class but actually fetches a platform-specific binary from obfuscated external sources, writes it to a hidden temporary location, sets executable permissions, and runs it detached without user awareness. There is no integrity verification of the downloaded binary, and the network destinations are designed to evade blocking. This behavior effectively results in remote code execution on any system that installs and imports this package.