The npm package bnpl-blocks-atom-bnpl-button version 35.4.7 contains malicious code that downloads and executes a platform-specific executable from obfuscated and suspicious hosts without verification. It uses covert channels such as DNS TXT record lookups to retrieve payloads, bypassing typical HTTP egress inspection. The malicious code executes immediately upon requiring the package, potentially compromising the entire system and exposing stored secrets and keys.