The npm package bnpl-blocks-atom-bnpl-faq-item version 35.8.2 contains malicious code that downloads and executes attacker-controlled binaries on the host machine. Upon requiring or importing the package, it fetches platform-specific binaries from obfuscated Cloudflare Workers URLs and a DNS-TXT fallback, writes them to temporary locations, sets executable permissions, and runs them detached. This behavior occurs automatically during module load, disguising its activity with benign-looking filenames. No patch or fix information is currently available.