The 'claims-domain' npm package (version 35.6.7) includes malicious functionality where, upon requiring the package, it loads a script that reconstructs destination hostnames from split strings to fetch native binaries from multiple Cloudflare Workers subdomains and fallback Russian domains. These binaries are written to temporary directories with disguised names, permissions are set to executable, and they are launched detached via shell commands. The code uses string concatenation to obscure references to 'child_process' and 'fs.chmodSync' APIs and falsely claims to be an analytics/telemetry SDK. The package's legitimate purpose does not require fetching or executing native binaries from such sources, indicating malicious intent. The delivery method is unpinned, unhashed, and obfuscated, increasing risk.

This malicious behavior can lead to arbitrary code execution on the host system where the package is installed, potentially compromising system integrity and confidentiality. Since the native binaries are fetched from untrusted and obfuscated sources, they may contain malware or backdoors. The execution is detached, making detection and containment more difficult. No known exploits in the wild are reported yet.

No official patch or remediation is currently available. Users should avoid using version 35.6.7 of the 'claims-domain' package. Audit and remove this package from projects and replace it with a trusted alternative. Monitor for updates or advisories from the package maintainers or security communities. Since the package fetches and executes untrusted binaries, manual removal and environment cleanup are recommended if this version was used.