Malicious code in claims-auth-domain (npm)
The npm package 'claims-auth-domain' version 35.5.4 contains malicious code that executes at import time. It loads a script that downloads a binary payload from attacker-controlled infrastructure, stages it on the host with a disguised filename, sets executable permissions, and runs it detached. The payload delivery uses obfuscated domain names and falls back to reconstructing the binary from DNS TXT records if HTTPS delivery fails. The code masquerades as telemetry and respects certain environment variables to evade detection. This results in full host code execution under attacker control upon loading the package.
AI Analysis
Technical Summary
The 'claims-auth-domain' npm package version 35.5.4 includes a malicious module (_vendor.js) that, when required, downloads a platform-specific binary from attacker infrastructure using obfuscated domain names. The binary is staged in temporary directories with disguised filenames, made executable, and executed detached from the main process. If HTTPS download fails, the payload is reconstructed from chunked DNS TXT records. The malicious code attempts to evade detection by presenting itself as telemetry and honoring environment variables like DISABLE_TELEMETRY and DO_NOT_TRACK. This leads to import-time full-host code execution controlled by the attacker.
Potential Impact
Any system that installs and loads the affected version of the 'claims-auth-domain' package is subject to full host code execution by an attacker. This allows arbitrary code execution with the privileges of the importing process, potentially leading to complete system compromise.
Mitigation Recommendations
No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using or installing version 35.5.4 of the 'claims-auth-domain' package. Consider removing the package from affected environments and scanning for any signs of compromise related to this malicious payload.
Malicious code in claims-auth-domain (npm)
Description
The npm package 'claims-auth-domain' version 35.5.4 contains malicious code that executes at import time. It loads a script that downloads a binary payload from attacker-controlled infrastructure, stages it on the host with a disguised filename, sets executable permissions, and runs it detached. The payload delivery uses obfuscated domain names and falls back to reconstructing the binary from DNS TXT records if HTTPS delivery fails. The code masquerades as telemetry and respects certain environment variables to evade detection. This results in full host code execution under attacker control upon loading the package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'claims-auth-domain' npm package version 35.5.4 includes a malicious module (_vendor.js) that, when required, downloads a platform-specific binary from attacker infrastructure using obfuscated domain names. The binary is staged in temporary directories with disguised filenames, made executable, and executed detached from the main process. If HTTPS download fails, the payload is reconstructed from chunked DNS TXT records. The malicious code attempts to evade detection by presenting itself as telemetry and honoring environment variables like DISABLE_TELEMETRY and DO_NOT_TRACK. This leads to import-time full-host code execution controlled by the attacker.
Potential Impact
Any system that installs and loads the affected version of the 'claims-auth-domain' package is subject to full host code execution by an attacker. This allows arbitrary code execution with the privileges of the importing process, potentially leading to complete system compromise.
Mitigation Recommendations
No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using or installing version 35.5.4 of the 'claims-auth-domain' package. Consider removing the package from affected environments and scanning for any signs of compromise related to this malicious payload.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12608
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735734bf8831d53913d174
Added to database: 08/05/2026, 15:31:00 UTC
Last enriched: 08/05/2026, 16:07:58 UTC
Last updated: 08/05/2026, 16:07:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.