The npm package 'checkout-desktop-bnpl' version 35.5.1 is a malicious package that pretends to provide checkout/BNPL functionality but instead executes arbitrary remote code. Upon requiring the package, it downloads a binary payload from attacker-controlled Cloudflare Workers endpoints, writes it to temporary directories with decoy names, sets executable permissions, and runs it without any integrity verification. This results in arbitrary remote code execution on any machine that imports this package.