The npm package bnpl-blocks-atom-bnpl-image-card version 35.6.1 contains malicious code that downloads and executes a native binary from Cloudflare Workers hostnames and fallback DNS-TXT records. The binary is saved under a disguised filename mimicking a Microsoft diagnostics tool and executed detached from the main process. This behavior is unrelated to the package's declared UI image card functionality.