The package claims-handle-api-response (npm) version 35.4.9 includes a malicious setup.js script that, upon requiring the main entry, downloads executable payloads from a rotating set of anonymous Cloudflare Workers domains. It writes these payloads to temporary directories under disguised names, sets executable permissions, and spawns them detached from the main process. If the HTTPS download fails, it falls back to retrieving base64-encoded binaries via DNS-TXT records from specific domains, reconstructs the binary, and executes it. The payload delivery method uses obfuscation techniques such as runtime hostname assembly and a stamp file to limit re-execution frequency. The delivered binaries are unrelated to the package's advertised functionality, indicating the package is a malware dropper.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary binaries from attacker-controlled infrastructure. This can lead to full system compromise, unauthorized persistence, and further malware deployment. The package's legitimate use as a REST client wrapper is subverted to deliver and execute malware, posing a severe risk to any environment where this package version is installed.

No official patch or remediation is currently documented. Users should immediately remove version 35.4.9 of claims-handle-api-response from their environments and avoid using this package version. Verify dependencies and lockfiles to ensure this malicious version is not included. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.