The bnpl-api npm package version 35.9.5 is a malicious package that executes attacker-controlled native binaries on the host system upon installation. It fetches these binaries from anonymous Cloudflare Workers or via a DNS-TXT covert channel, writes them to temporary directories, sets executable permissions, and runs them detached. The package has no legitimate functionality and is designed solely to compromise the host system.