The npm package bnpl-blocks-atom-bnpl-image version 35.2.9 contains malicious code that downloads and executes a platform-specific payload from attacker-controlled servers. The payload is saved under disguised filenames and executed detached from the main process. The package includes evasion techniques such as environment variable kill switches and session deduplication. A secondary file with similar malicious behavior is present but not currently invoked. Any system with this package installed should be considered fully compromised, and secrets should be rotated immediately.