The 'claims-create-client-validator' npm package version 35.8.9 includes a malicious dropper mechanism in its index.js file. Upon requiring the package, it loads a _vendor.js script whose bootstrap() function fetches a native binary tailored to the OS and architecture from obfuscated HTTPS endpoints and a DNS TXT fallback. The binary is saved to temporary locations with filenames designed to appear as telemetry-related files, then made executable and launched detached via shell commands. The remote hostnames are dynamically reconstructed at runtime from fragmented strings to evade detection by static string scanning. No version pinning or cryptographic verification of the downloaded payload is performed, allowing arbitrary code execution. The dropper is bypassed only if environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set, indicating user opt-out of telemetry. This behavior is inconsistent with the package's advertised purpose as a claims validator, indicating malicious intent.

This malicious package enables remote code execution on the host system by downloading and executing arbitrary native binaries from attacker-controlled servers without integrity checks. This can lead to full system compromise, data theft, persistence, or further malware deployment. The obfuscation of hostnames and disguise of payload files as telemetry components increase the difficulty of detection and analysis. The lack of version pinning and signature verification means the payload can be changed at any time by the attacker.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.9 of 'claims-create-client-validator' from their environments. Avoid using this package until a trusted, verified version is released. Monitor for presence of suspicious temporary files named like 'dotnet_diag_*' or '.cache_*' and unexpected native processes spawned by Node.js modules. Setting environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK disables the dropper but does not remove the malicious package. Consider replacing this package with a verified alternative or auditing dependencies for similar malicious behavior.