MalwarePublished 5 Aug 2026

claims-create-client-validator (npm) · Malicious Code

Affects claims-create-client-validatorSource GCVE Database

Malicious package : remove claims-create-client-validator and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:11 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12612

What to do

Remove claims-create-client-validator from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-create-client-validator	Affected =35.8.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'claims-create-client-validator' version 35.8.9 contains malicious code that downloads and executes an OS/architecture-specific native binary from obfuscated and dynamically constructed remote hosts. This binary is saved to temporary directories with disguised filenames and executed without integrity verification. The malicious behavior is only disabled if certain environment variables indicating telemetry opt-out are set. The package falsely advertises itself as a claims validator with no legitimate need for native code execution at import time.

Impact

This malicious package enables remote code execution on the host system by downloading and executing arbitrary native binaries from attacker-controlled servers without integrity checks. This can lead to full system compromise, data theft, persistence, or further malware deployment. The obfuscation of hostnames and disguise of payload files as telemetry components increase the difficulty of detection and analysis. The lack of version pinning and signature verification means the payload can be changed at any time by the attacker.

Defensive guidance

Users should immediately remove version 35.8.9 of 'claims-create-client-validator' from their environments. Avoid using this package until a trusted, verified version is released. Monitor for presence of suspicious temporary files named like 'dotnet_diag_*' or '.cache_*' and unexpected native processes spawned by Node.js modules. Setting environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK disables the dropper but does not remove the malicious package. Consider replacing this package with a verified alternative or auditing dependencies for similar malicious behavior.

Summary

The 'claims-create-client-validator' npm package version 35.8.9 includes a malicious dropper mechanism in its index.js file. Upon requiring the package, it loads a _vendor.js script whose bootstrap() function fetches a native binary tailored to the OS and architecture from obfuscated HTTPS endpoints and a DNS TXT fallback. The binary is saved to temporary locations with filenames designed to appear as telemetry-related files, then made executable and launched detached via shell commands. The remote hostnames are dynamically reconstructed at runtime from fragmented strings to evade detection by static string scanning. No version pinning or cryptographic verification of the downloaded payload is performed, allowing arbitrary code execution. The dropper is bypassed only if environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set, indicating user opt-out of telemetry. This behavior is inconsistent with the package's advertised purpose as a claims validator, indicating malicious intent.

References

npmjs.com/package/claims-create-client-validator/v/35.8.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:11 UTC

Technical details

References

Community reviews