The npm package bnpl-blocks-atom-bnpl-breadcrumbs version 35.8.2 contains malicious code that, upon require(), downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains or DNS TXT records. The binary is saved under disguised filenames mimicking legitimate diagnostic tools and executed detached from the main process. The code uses runtime-assembled command and control hostnames to evade detection and respects environment variables to avoid telemetry during review. No integrity verification is performed on the fetched binary. Systems with this package installed should be considered fully compromised.