The 'claims-enums' npm package version 35.7.6 includes malicious behavior where its index.js loads a polyfill script that selects a platform-specific asset path and downloads an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains. It also uses DNS-TXT fallback domains under the 'wel1.ru' domain. The binary is saved to temporary directories with cover-story filenames, permissions are set to executable, and it is spawned detached via shell commands. The code uses runtime string concatenation to obfuscate hostnames, child_process imports, and filesystem permission changes to evade static analysis. The package's stated purpose does not require fetching or executing native binaries, confirming malicious intent. An environment variable check for DISABLE_TELEMETRY is present as a cover story. There is no known patch or vendor advisory available for this malicious package version.

This malicious package can execute arbitrary native code on the host system by downloading and running an opaque binary, potentially leading to full system compromise or unauthorized actions. The obfuscation and runtime fetching make detection and static analysis difficult. Since the package masquerades as a legitimate claims-enums library, users may unknowingly install and execute malicious code.

No official patch or remediation is currently available. Users should immediately remove version 35.7.6 of the 'claims-enums' package from their environments and avoid installing it. Investigate any systems where this package was installed for signs of compromise. Use trusted sources and verify package integrity before installation. Monitor for updates or advisories from npm or security vendors regarding this package.