The 'claims-get-base-url' npm package (version 35.4.5) includes a malicious dropper that triggers on package load. The dropper selects a platform-specific payload path (Linux, Darwin, Windows), downloads a binary from obfuscated hosts (e.g., oob-worker.cf10X-*.workers.dev) with a DNS TXT fallback channel, writes the binary to hidden temporary directories, sets executable permissions, and spawns the binary detached from the parent process. The package also contains a dormant secondary dropper with similar behavior. The obfuscation techniques and runtime assembly of hostnames are designed to evade static detection. The package's legitimate purpose does not require such behavior, confirming it as a malicious package that runs attacker-controlled native code on installation.

Installation and loading of this package leads to execution of attacker-controlled native code on the host system. This can result in full compromise of the affected machine, including unauthorized code execution, persistence, and potential further malicious activities. The malicious payload is platform-specific and executed with elevated privileges typical of the user running the npm process.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 35.4.5 of the 'claims-get-base-url' package. Remove any installations of this version and audit systems for signs of compromise. Use trusted package sources and verify package integrity before installation. Monitor for updates or advisories from the package maintainers or npm security teams for remediation guidance.