The 'claims-get-percentage-value' npm package (version 35.4.6) includes malicious code in its main entry point (index.js) that unconditionally requires a module (_platform.js). This module fetches a platform-specific executable from multiple hardcoded hosts, including oob-worker.cf103-070.workers.dev and sdk.dl.wel1.ru domains, using DNS-TXT fallback mechanisms. The downloaded executable is saved as a hidden file in the system's temporary directory (.cache_<random> on Unix or dotnet_diag_<random>.exe on Windows), given executable permissions, and launched detached via shell commands. No hash or signature verification is performed on the downloaded binary, increasing risk. The package attempts to disguise this behavior with environment variable checks (DISABLE_TELEMETRY, DO_NOT_TRACK) and naming conventions suggesting telemetry functionality, which is unrelated to the package's intended purpose of providing a trivial percentage-value class.

The malicious code enables remote code execution by downloading and running an unverified binary from attacker-controlled hosts. This can lead to arbitrary code execution on the affected system, potentially compromising system integrity, confidentiality, and availability. Because the binary is executed without verification and runs detached, it may evade detection and persist on the system. The package's telemetry cover story may delay detection by defenders.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.4.6 of 'claims-get-percentage-value' from their projects and replace it with a trusted alternative or a verified clean version if available. Avoid installing or using this package version. Monitor for any unexpected processes or files matching the described patterns in temporary directories. Check vendor or repository advisories for updates or official guidance.