constructor-blocks-common@35.5.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Unconsented arbitrary code execution under the importing process user.

remote payload download and detached native execution

The normal module entrypoint suppresses errors while importing _helpers.js. That helper fetches an opaque binary from rotating remote hosts, with DNS TXT reconstruction as fallback; it writes the bytes to a temporary executable path and launches it detached via cmd.exe or /bin/sh. This is import-time remote code execution unrelated to the documented shared-primitives API.

Direct source inspection confirms an import-triggered staged payload downloader and executor. Lack of lifecycle hooks does not mitigate runtime arbitrary code execution.