The npm package bnpl-blocks-atom-bnpl-info-card version 35.7.3 contains malicious code that executes upon installation or require(). It reconstructs obfuscated hostnames to contact Cloudflare Workers subdomains and uses a DNS-TXT covert channel to download a base64-encoded binary payload. This payload is saved to temporary directories under disguised filenames, made executable, and launched in a detached process, enabling full remote code execution on the host. A secondary module acts as a backup dropper with similar behavior. Any system with this package installed should be considered fully compromised.