The malicious code in [email protected] operates by loading a loader script that selects a platform-specific temporary path and downloads a binary executable over HTTPS from dynamically reconstructed anonymous *.workers.dev domains. If HTTPS retrieval fails, it falls back to a covert DNS-TXT channel to retrieve base64-encoded payload chunks from obfuscated domains, concatenates and decodes them, then writes and executes the binary. The binary is saved with stealth filenames (e.g., dotnet_diag_<rand>.exe on Windows) and executed detached via system shell commands. No integrity checks such as hash or signature verification are performed on the downloaded payload, increasing the risk of executing malicious code.

This malicious behavior allows arbitrary code execution on the host system where the package is installed, potentially leading to full system compromise or unauthorized actions. The lack of integrity verification and use of obfuscated domains complicate detection and mitigation. No known exploits in the wild have been reported yet.

No official patch or remediation guidance is currently available for this malicious package version. Users should avoid using claims-claims-api-adapters version 35.7.9 and remove it from their environments if present. Employing supply chain security best practices such as verifying package provenance and using trusted sources is recommended. Monitor for updates or advisories from the package maintainers or npm registry.