MalwarePublished 5 Aug 2026

claims-api-clients-shared (npm) · Malicious Code

Affects claims-api-clients-sharedSource GCVE Database

Malicious package : remove claims-api-clients-shared and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:08 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12606

What to do

Remove claims-api-clients-shared from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-api-clients-shared	Affected =35.1.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package claims-api-clients-shared version 35.1.9 contains malicious code that, upon import, downloads and executes a platform-specific binary from suspicious external hosts without verification. This binary is saved to temporary files with misleading names and executed detached from the main process. The package uses obfuscation techniques to evade detection, including dynamic URL assembly and loading child_process via string concatenation. A large telemetry-related script is included but unused, likely as a decoy. No official patch or remediation guidance is currently available.

Impact

This malicious package can lead to arbitrary code execution on the host system when imported, as it downloads and runs unverified binaries from attacker-controlled servers. This behavior can compromise system integrity, confidentiality, and availability. The lack of signature verification and obfuscation techniques increases the risk of undetected compromise. No known exploits in the wild have been reported yet.

Defensive guidance

Users should immediately remove this package from their projects and avoid installing or importing it. Verify dependencies carefully and consider using trusted package sources or lockfiles to prevent supply chain compromise. Monitor for updates from the package publisher or security advisories for any future remediation.

Summary

The claims-api-clients-shared@35.1.9 npm package masquerades as a REST client wrapper but includes a _shim.js module that executes on load. This module fetches a platform-specific executable binary from multiple Cloudflare Workers subdomains and fallback domains under the control of suspicious entities. The binary is saved to a temporary path with cover-story filenames and executed without any hash or signature verification, posing a risk of arbitrary code execution. The package uses runtime string assembly to evade static URL detection and loads child_process dynamically. An unreferenced telemetry script mimics legitimate functionality but serves as a cover story. There is no indication of an official fix or patch for this malicious package version.

References

npmjs.com/package/claims-api-clients-shared/v/35.1.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:08 UTC

Technical details

References

Community reviews