constructor-blocks-landings@35.5.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package entrypoint.

Remote code execution as the consuming application's user.

Import-time download, DNS fallback, temp-file drop, and detached execution.

On module import, index.js silently requires setup.js. Unless an opt-out variable is set or a short-lived stamp exists, setup.js downloads a platform-specific binary from obfuscated Workers domains, or reconstructs one from DNS TXT records. It writes the bytes under /var/tmp (or the Windows temp directory), marks non-Windows files executable, then starts them detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain.

The package’s stated component API does not require a hidden import-time executable downloader. The direct source establishes a concrete remote payload execution path.