MalwarePublished 5 Aug 2026

constructor-blocks-renderer-mailings (npm) · Malicious Code

Affects constructor-blocks-renderer-mailingsSource GCVE Database

Malicious package : remove constructor-blocks-renderer-mailings and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12664

What to do

Remove constructor-blocks-renderer-mailings from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmconstructor-blocks-renderer-mailings	Affected =35.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package constructor-blocks-renderer-mailings version 35.3.3 contains malicious code that downloads and executes platform-specific payloads from obfuscated command-and-control (C2) servers. It uses HTTPS requests to fetch executables saved under deceptive names in temporary directories and executes them detached from the main process. If HTTPS fetches fail, it falls back to a covert DNS TXT record channel to retrieve and execute base64-encoded payloads. The malicious behavior is unrelated to the package's stated purpose and employs obfuscation techniques to evade detection.

Impact

This malicious package enables remote code execution on the host system by downloading and executing arbitrary payloads from attacker-controlled servers. The obfuscation and fallback covert channel increase the difficulty of detection and mitigation. The impact includes potential full system compromise, persistence, and further malicious activity initiated by the attacker. The threat is significant given the ability to execute arbitrary code detached from the main process.

Defensive guidance

Users should immediately remove constructor-blocks-renderer-mailings version 35.3.3 from their environments and avoid installing it. Employ package integrity verification and source validation to prevent installation of malicious or tampered packages. Monitor for and block network connections to the identified C2 domains.

Summary

The malicious code in constructor-blocks-renderer-mailings@35.3.3 activates on module load by requiring a bridge script that reconstructs obfuscated C2 hostnames from split string arrays. It issues HTTPS GET requests to download platform-specific executables, which are saved to temporary directories with deceptive filenames, permissioned to be executable, and launched detached from the parent process. When HTTPS retrieval fails, the code uses DNS TXT record resolution against specific subdomains to assemble base64-encoded payload chunks and execute them. The C2 hostnames and delivery mechanisms are obfuscated to evade static analysis, and the payload delivery is unpinned and unverified, indicating a high risk of arbitrary code execution. A large sibling telemetry bundle is present but not loaded at import time.

References

npmjs.com/package/constructor-blocks-renderer-mailings/v/35.3.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:20 UTC

Technical details

References

Community reviews