The npm package bnpl-blocks-atom-bnpl-dropdown version 35.5.5 contains malicious code that executes arbitrary code on the host system upon installation or require. It downloads and executes opaque binaries from attacker-controlled infrastructure across Linux, macOS, and Windows platforms. This results in full host compromise, potentially exposing all stored secrets and keys.