The claims-get-indexed-selector npm package version 35.8.7 includes a malicious payload that triggers on module load. The index.js file requires a _polyfill.js script that reconstructs network destinations from split string arrays to evade detection. It downloads a native binary executable over HTTPS from domains such as cf*.workers.dev and *.dl.wel1.ru, saves it to /var/tmp/.cache_<hex> or TEMP\dotnet_diag_<hex>.exe with cover-story filenames, sets permissions to 0755, and executes it detached using shell commands. If the HTTPS retrieval fails, the binary is fetched covertly via DNS-TXT records, which are base64-encoded and reassembled. The binary is not verified by hash or signature, allowing arbitrary code execution. The package is presented as a benign runtime support module, but the underlying behavior is malicious and attacker-controlled.

This malicious package can lead to arbitrary code execution on systems that install and load it, as it downloads and executes an attacker-controlled native binary without verification. This can compromise system integrity, confidentiality, and availability. The use of covert DNS channels for fallback retrieval increases stealth and persistence. The lack of integrity checks on the binary increases risk of undetected compromise.

No official patch or remediation is currently available. Users should immediately avoid using claims-get-indexed-selector version 35.8.7. Remove the package from all environments and replace it with trusted alternatives. Monitor for any signs of compromise related to this package. Since no fix is confirmed, patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates. Employ supply chain security best practices such as verifying package provenance and using package integrity checks where possible.