The npm package bnpl-blocks-atom-bnpl-news-card version 35.6.8 contains malicious code that downloads and executes a native binary from obfuscated Cloudflare Workers hosts and DNS-TXT fallback domains. This behavior occurs immediately upon requiring the package, which is unexpected given its advertised purpose as a UI news card. The malicious payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. Systems with this package installed should be considered fully compromised.