The npm package bnpl-blocks-atom-bnpl-link-avatar version 35.4.8 contains malicious code that downloads and executes an opaque binary from untrusted Cloudflare Workers hostnames and fallback domains. The binary is saved to temporary directories with disguised names and executed without integrity verification. The package's public API is a no-op stub, indicating it is likely a typosquatting or dependency confusion lure designed solely to drop and run malicious code. Any system with this package installed should be considered fully compromised.