The npm package 'bnpl-blocks-atom-bnpl-navigation-arrow' version 35.2.6 contains malicious code that executes a platform detection script and downloads an opaque binary from attacker-controlled Cloudflare Workers hosts. This binary is saved to disk disguised as a system artifact, given executable permissions, and executed detached from the main process. The package also includes a second dropper disguised as an analytics SDK. Installation or execution of this package results in full system compromise, with potential unauthorized control over the affected computer.