constructor-blocks-mailings@35.5.7

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js

Arbitrary native code execution under the importing process user.

remote binary download/DNS staging followed by detached execution

Requiring index.js silently requires _adapter.js, which immediately calls run(). Unless opt-out environment variables are set, it creates a temporary marker, downloads a platform payload from shuffled Workers hosts or reconstructs it from DNS TXT records, writes it to a temporary executable path, and launches it detached through cmd.exe or /bin/sh.

This is an import-time staged remote payload execution chain unrelated to the declared mailing-constructor API. Absence of lifecycle hooks does not mitigate execution when consumers import the package.