The 'claims-fixtures-shared' npm package version 35.8.6 includes malicious functionality triggered upon requiring the package. It loads a helper script that reconstructs obfuscated hostnames and DNS TXT resolvers to evade static analysis. It then downloads a platform-specific binary via HTTPS, saves it to a temporary directory under a disguised filename, sets executable permissions, and executes it detached using system shell commands. Despite comments suggesting SHA-256 integrity checks, no actual verification is performed. The package uses environment variables to frame this behavior as telemetry but in reality stages and runs arbitrary attacker-controlled code. This behavior is unrelated to the package's stated purpose as a fixtures helper.

This malicious package can lead to arbitrary code execution on any system that installs and requires version 35.8.6 of 'claims-fixtures-shared'. The attacker-controlled binary is downloaded and executed without integrity verification, enabling potential full system compromise or further malicious activity. The obfuscation techniques used hinder detection by static scanners.

No official patch or remediation is currently documented. Users should immediately avoid using 'claims-fixtures-shared' version 35.8.6 and remove it from their environments. Verify dependencies and replace this package with a trusted alternative. Monitor for any unexpected binaries or processes spawned from this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.