The 'claims-constants' npm package version 35.2.2 includes malicious functionality in its index.js file, which unconditionally requires a helper script that executes immediately on import. This script downloads platform-specific binaries from obfuscated Cloudflare Workers subdomains, reconstructing hostnames at runtime to evade static detection. If the primary download method fails, it uses a DNS-TXT record covert channel to fetch and reconstruct a payload from multiple TXT records under specific domains. The downloaded binaries are saved to temporary directories with disguised filenames, permissions are set to executable, and the binaries are spawned detached from the main process. The package's name and declared purpose do not align with this behavior, confirming it as a malicious package.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution, system compromise, or persistence. The use of obfuscated domains and covert DNS channels complicates detection and analysis. Because the binaries run detached and with executable permissions, they may evade casual inspection and persist beyond the lifecycle of the initial process.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.2.2 of 'claims-constants' from their environments and avoid installing this package. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any suspicious processes or files matching the described patterns and clean affected systems accordingly. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.