The npm package 'bnpl-blocks-atom-bnpl-feedback' version 35.7.5 contains malicious code that downloads and executes unsigned binaries from obfuscated Cloudflare Workers subdomains and fallback DNS TXT records. The package masquerades as a harmless data mapper but performs unauthorized network activity to fetch and run potentially harmful executables on the host system. This behavior leads to full system compromise, risking exposure of all stored secrets and keys.