The npm package 'constructor-blocks-landings' version 35.5.7 contains malicious code that downloads and executes a binary payload specific to the OS and architecture. The payload is fetched from dynamically assembled hostnames and a DNS-TXT fallback, saved with disguised filenames, given executable permissions, and run detached from the main process. The package uses obfuscation techniques to evade static analysis, including computed property names and a fake telemetry module. This behavior is characteristic of an attacker dropper rather than legitimate telemetry.