The 'claims-format-masked-phone-number' npm package version 35.9.8 includes a malicious payload that, upon requiring the package, loads a polyfill script which dynamically assembles hostnames to fetch native binaries from Cloudflare Workers subdomains. These binaries are written to temporary locations with executable permissions and launched without verification, allowing arbitrary code execution. If this primary channel fails, a fallback mechanism retrieves executable code via DNS TXT queries from specified domains, decodes it, and executes it similarly. The package masquerades as a phone-number masking library but contains unrelated telemetry-related files and comments, further indicating malicious behavior.

This malicious package enables remote code execution on the host system by downloading and executing unsigned native binaries from attacker-controlled infrastructure. This can lead to full system compromise, unauthorized access, data theft, or further malware deployment. The lack of signature verification and use of obfuscated runtime hostname assembly complicate detection and mitigation.

No official patch or fix is currently available for this malicious package version. Users should immediately remove version 35.9.8 of 'claims-format-masked-phone-number' from their environments and avoid installing it. Audit existing systems for the presence of this package and any dropped binaries or suspicious processes. Employ supply chain security best practices such as verifying package provenance and using trusted package registries. Monitor for updates from the package maintainers or security advisories for remediation guidance.