The claims-accounts-lib package (version 35.6.6) includes a malicious setup.js script that triggers on package load. It downloads platform-specific binaries from a rotating list of Cloudflare-Workers hosts using obfuscated URL concatenation to evade static scans. The binaries are saved to temporary directories with deceptive filenames, permissioned to be executable, and then launched detached via system shells (cmd.exe on Windows, /bin/sh on Unix). If HTTPS endpoints fail, the package falls back to a DNS-TXT record covert channel to reconstruct and execute the payload. Additionally, a sibling telemetry module contains similar dropper functionality. No cryptographic verification of the downloaded binaries is performed, enabling arbitrary attacker-controlled code execution on any system that requires this package.

Any system that installs or requires claims-accounts-lib version 35.6.6 is at risk of arbitrary code execution by an attacker-controlled binary. This can lead to full system compromise, data theft, or further malware deployment. The malicious behavior activates immediately upon requiring the package, making it a critical supply chain threat.

No official patch or remediation is currently documented for claims-accounts-lib version 35.6.6. Users should immediately cease using this package version and remove it from their environments. Avoid requiring or installing this package until a trusted, verified version is available. Monitor for any updates or advisories from the package maintainers or security vendors. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.