The npm package bnpl-blocks-atom-bnpl-card version 35.9.4 contains malicious code that executes attacker-controlled native binaries at require-time. It downloads and runs opaque native executables on the host system, using obfuscated hostnames and evasion techniques to avoid detection. This results in full compromise of any computer running or having installed this package.