The npm package bnpl-blocks-atom-bnpl-integrations-breadcrumbs version 35.2.9 contains malicious code that downloads and executes a platform-specific binary from anonymous, mutable hosts. The package uses obfuscated code to reconstruct hostnames and fetch a binary without any integrity verification, then executes it detached on the host system. This behavior effectively makes any system with this package installed fully compromised, potentially exposing all stored secrets and keys.