The 'claims-api-adapters' npm package (version 35.7.8) unconditionally loads a module that invokes a bootstrap function at the top level. This function selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts, which are constructed dynamically from split string arrays to evade detection. The binary is saved to disguised temporary file paths with cover names such as 'analytics_state' or 'dotnet_diag_', permissions are set to executable, and it is spawned detached from the main process. If HTTPS mirrors fail, a DNS TXT fallback channel reconstructs a base64 payload from specially crafted subdomains. This malicious execution occurs on any import of the package unless specific environment variables are set to opt out. The package falsely presents itself as an SDK adapter, but its true behavior is to execute unauthorized native code on the host.

This malicious package leads to unauthorized execution of native binaries on the host system, potentially allowing attackers to run arbitrary code with the privileges of the importing process. The use of obfuscated endpoints, disguised file names, and detached execution aims to evade detection and persist on the host. This can compromise system integrity and confidentiality depending on the executed payload.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using 'claims-api-adapters' version 35.7.8 and remove it from their environments. Since the malicious behavior triggers on import, do not import or install this package. Monitor for updates from the package maintainers or npm advisories for any official fixes or removals. Consider using environment variables to opt out if documented, but the safest approach is to avoid the package entirely.