The npm package 'constructor-blocks-renderer-landings' version 35.2.5 contains malicious code that, upon import, downloads and executes a platform-specific executable from hardcoded Cloudflare Workers hosts. It writes the executable to temporary directories with disguised filenames, sets executable permissions, and runs it detached via shell commands. If HTTPS fetching is blocked, it uses a DNS-TXT covert channel to retrieve the payload. A second similar dropper module is embedded in the package, using obfuscated code to evade static analysis.