The 'claims-get-error-string' npm package version 35.5.9 contains embedded malicious functionality. Upon requiring the package, it loads a script that downloads a platform-specific binary from obfuscated Cloudflare Workers URLs. The binary is saved to temporary locations with benign filenames, permissions are set to executable, and it is launched detached from the main process using shell commands. The package also implements a DNS-TXT record covert channel under the domain wel1.ru to reconstruct the payload as a fallback delivery mechanism. A secondary module named lib/telemetry.js, which includes similar payload dropper logic, is bundled but not executed in this version. The payload is opaque, with no integrity verification such as hash pinning or signature checks, allowing potential undetected execution of malicious code.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or unauthorized actions. The use of covert DNS channels for payload delivery complicates detection and mitigation. The absence of integrity checks on the downloaded payload increases the risk of executing tampered or additional malicious code. The secondary telemetry module, although not active in this version, indicates potential for further malicious capabilities.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove 'claims-get-error-string' version 35.5.9 from their environments and avoid installing it. Employ package integrity verification and source validation before installation. Monitor for any unexpected binaries in temporary directories and network traffic to suspicious domains such as the specified Cloudflare Workers hosts and wel1.ru. Consider using trusted package registries and tools that detect malicious npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.