The npm package 'bnpl-blocks-desktop-bnpl-anchor-title' version 35.2.5 contains malicious code that downloads and executes a platform-specific binary from attacker-controlled infrastructure. This binary is fetched without verification, written to a temporary location, made executable, and executed detached from the main process. The package uses obfuscation techniques to evade detection and includes telemetry components as a cover. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.