The 'constructor-blocks-landings' npm package version 35.5.7 includes malicious functionality triggered upon requiring its main entrypoint. It loads setup.js which dynamically constructs hostnames to download a binary payload tailored to the host OS and architecture. The binary is saved under disguised names in temporary directories, permissioned for execution, and launched in a detached manner to avoid detection. The package employs obfuscation by accessing Node.js built-ins through computed property names and bundles a fake telemetry module to mask its true intent. The use of DNS-TXT fallback and hostname reassembly indicates covert communication channels typical of attacker droppers.

This malicious package can execute arbitrary code on the host system by downloading and running an attacker-controlled binary in the background. This can lead to full system compromise depending on the payload's capabilities. The obfuscation and detached execution make detection and analysis more difficult, increasing the risk to users who install this specific package version.

No official patch or remediation is currently documented. Users should avoid using version 35.5.7 of the 'constructor-blocks-landings' npm package. Remove any installations of this version and verify that no unauthorized binaries remain on the system. Monitor for updates or advisories from the package maintainers or security vendors for remediation guidance.