The npm package bnpl-blocks-atom-bnpl-fade-overflow version 35.7.2 contains malicious code that, upon requiring the package, downloads and executes platform-specific native payloads from obfuscated and suspicious external domains. These payloads are saved to temporary directories with misleading filenames and executed with elevated permissions, potentially compromising the host system. The package also includes a disguised analytics SDK that performs similar malicious actions. Any system with this package installed should be considered fully compromised, and immediate secret/key rotation and package removal are strongly advised.