The 'constructor-blocks-renderer-landings' npm package version 35.2.5 includes malicious functionality in its main entry point (index.js) that unconditionally loads a polyfill script. This script fetches a platform-specific executable from one of four hardcoded Cloudflare Workers domains, assembles the hostnames at runtime to evade detection, writes the executable to temporary directories under misleading filenames, modifies permissions to make it executable, and spawns it detached via shell commands. If the HTTPS fetch is blocked, a fallback mechanism uses a DNS-TXT record covert channel to retrieve the payload in base64 chunks. Additionally, a second dropper module with identical behavior is bundled in lib/telemetry.js, using runtime string joining to obscure module and API names, further complicating static analysis and detection.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary platform-specific binaries without user consent. This can lead to full system compromise, data theft, or further malware deployment. The use of obfuscation and covert channels increases the difficulty of detection and mitigation.

No official patch or remediation is currently documented. Users should avoid using version 35.2.5 of 'constructor-blocks-renderer-landings'. It is recommended to remove this package from projects and replace it with a trusted alternative. Monitor for updates from the package maintainer or security advisories for any official fixes. Due to the nature of the malicious behavior, manual removal and system inspection for persistence mechanisms are advised.