bnpl-blocks-atom-bnpl-anchor-menu@35.8.5

Analysis

The package's index.js requires _loader.js, which acts as a multi-stage dropper. On load it downloads a remote binary over HTTPS from Cloudflare Workers endpoints (oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) at path /pkg/package (platform-specific variants /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), with a DNS-TXT chunked-retrieval fallback via c[.]sdk[.]dl[.]wel1[.]ru. The downloaded payload is written to a hidden file (.cache_<hex> in /var/tmp, or dotnet_diag_<hex>.exe in TEMP on Windows) and executed as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c '<path> &' on Unix). The loader writes an analytics_state stamp file to throttle re-execution. The package is a benign-looking UI module whose real behaviour is remote binary download and execution.