The 'claims-format-money' npm package version 35.5.5 includes malicious functionality in its _bootstrap.js and lib/telemetry.js files. These scripts dynamically reconstruct per-platform download URLs from fragmented strings, leveraging DNS TXT record fallbacks, to download unpinned binaries from suspicious hosts. The binaries are saved to temporary directories with misleading filenames, permissions are set to executable, and the binaries are executed detached from the main process. The package attempts to disguise this activity as analytics telemetry, which is inconsistent with its declared purpose. This behavior identifies the package as a supply-chain binary dropper, posing a significant risk to users who install or import this package.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary binaries without user consent or verification. This can lead to unauthorized system compromise, persistence, and potentially further malicious activity. The deceptive nature of the dropper, including runtime URL reconstruction and disguised filenames, increases the difficulty of detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.5.5 of 'claims-format-money' from their environments and avoid installing or importing this package. Review dependency trees for inclusion of this package and replace it with trusted alternatives. Monitor for any suspicious activity related to dropped binaries in temporary directories. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.