constructor-blocks-renderer-mailings@35.3.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package entrypoint.

Arbitrary attacker-controlled code executes as the importing user.

import-time remote binary download, drop, and execution

Requiring index.js silently loads _bridge.js. Its bootstrap routine downloads an unverified platform-specific payload over HTTPS, or reconstructs one from DNS TXT records, writes it into a temporary directory, marks it executable on Unix, and launches it through a detached shell or cmd.exe process. This provides the remote operator arbitrary code execution without an explicit user command.

The package has a concrete import-time remote payload execution chain, not merely telemetry primitives. Absence of lifecycle scripts does not mitigate execution when normal package import triggers the bridge.