The malicious code in 'claims-historical-claims-api-adapters' version 35.7.6 unconditionally requires a loader module that reconstructs obfuscated remote hostnames to download binaries over HTTPS. These binaries are saved to temporary directories with disguised names, permissions are set to executable, and they are spawned detached from the main process. A secondary dropper module, framed as an analytics SDK, uses dynamic property assembly to perform the same fetch-write-execute pattern. The obfuscation of host strings, module names, filenames, and detached execution strongly indicate a canonical import-time RCE dropper embedded in the package.

This malicious package enables remote code execution on any system that imports it, allowing attackers to run arbitrary binaries with the permissions of the importing process. This can lead to full system compromise, data theft, or further malware deployment. The malicious code executes automatically upon module load without user interaction.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.7.6 of 'claims-historical-claims-api-adapters'. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainers or npm registry. Consider using trusted package sources and supply chain security tools to detect malicious packages.