The 'constructor-blocks-mailings' npm package version 35.5.7 includes malicious functionality triggered at load time. Its index.js loads an adapter that selects a platform-specific endpoint and downloads an opaque binary from obfuscated Cloudflare Workers hosts using a DNS-TXT base64 fallback channel via numbered subdomains under *.dl.wel1.ru. The binary is saved to temporary directories with deceptive filenames, permissioned as executable (chmod 0755), and executed detached via shell commands. Hostnames are constructed from split string fragments to evade static analysis. No hash or signature verification is performed on the downloaded binary. This combination of techniques matches a hostile install/load-time dropper designed to execute arbitrary code on the host.

This malicious package can execute arbitrary code on the host system at load time without user consent or verification. The opaque binary downloaded and executed may perform any malicious actions, potentially compromising system integrity, confidentiality, and availability. The use of obfuscated endpoints and covert DNS-TXT channels complicates detection and blocking. There is no indication of known exploits in the wild yet, but the risk of compromise is significant if the package is used.

No official patch or remediation guidance is currently available. Users should avoid using version 35.5.7 of the 'constructor-blocks-mailings' package. Audit and remove this package from projects and dependency trees. Monitor for updates from the vendor or npm advisory for any official fixes or removal notices. Consider blocking the identified malicious domains and network indicators at the network perimeter. Due to the lack of patch information, patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.