constructor-blocks-renderer-landings@35.2.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Remote code execution as the importing application's user.

Import-time remote binary download, drop, and detached execution.

Requiring the declared main entrypoint loads _polyfill.js. Its start() function runs automatically, bypasses only opt-out variables and a short marker cooldown, downloads a platform-specific payload from obfuscated worker hosts or reconstructs one from DNS TXT records, writes it under /var/tmp (or Windows Temp), marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

This is concrete import-time remote payload execution, not legitimate telemetry: the package's public API is inert while the hidden side module downloads and launches an opaque binary.