MalwarePublished 5 Aug 2026

claims-get-indexed-selector (npm) · Malicious Code

Affects claims-get-indexed-selectorSource GCVE Database

Malicious package : remove claims-get-indexed-selector and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:08 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12621

What to do

Remove claims-get-indexed-selector from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-get-indexed-selector	Affected =35.8.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package claims-get-indexed-selector version 35.8.7 contains malicious code that executes a binary dropper upon module load. It downloads a native binary from attacker-controlled hosts, writes it to temporary locations with misleading filenames, sets executable permissions, and runs it detached. If HTTPS download fails, it uses a covert DNS-TXT channel to retrieve the binary in chunks. No integrity verification is performed on the downloaded binary. The package masquerades as a benign runtime support module, but the delivered binary is opaque and potentially harmful.

Impact

This malicious package can lead to arbitrary code execution on systems that install and load it, as it downloads and executes an attacker-controlled native binary without verification. This can compromise system integrity, confidentiality, and availability. The use of covert DNS channels for fallback retrieval increases stealth and persistence. The lack of integrity checks on the binary increases risk of undetected compromise.

Defensive guidance

Users should immediately avoid using claims-get-indexed-selector version 35.8.7. Remove the package from all environments and replace it with trusted alternatives. Monitor for any signs of compromise related to this package. Employ supply chain security best practices such as verifying package provenance and using package integrity checks where possible.

Summary

The claims-get-indexed-selector npm package version 35.8.7 includes a malicious payload that triggers on module load. The index.js file requires a _polyfill.js script that reconstructs network destinations from split string arrays to evade detection. It downloads a native binary executable over HTTPS from domains such as cf*.workers.dev and *.dl.wel1.ru, saves it to /var/tmp/.cache_<hex> or TEMP\dotnet_diag_<hex>.exe with cover-story filenames, sets permissions to 0755, and executes it detached using shell commands. If the HTTPS retrieval fails, the binary is fetched covertly via DNS-TXT records, which are base64-encoded and reassembled. The binary is not verified by hash or signature, allowing arbitrary code execution. The package is presented as a benign runtime support module, but the underlying behavior is malicious and attacker-controlled.

References

npmjs.com/package/claims-get-indexed-selector/v/35.8.7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:08 UTC

Technical details

References

Community reviews