The 'claims-historical-claims-domain' npm package version 35.4.4 includes malicious functionality where the index.js file loads a bridge script that constructs obfuscated URLs to download a binary executable from external hosts. The binary is saved to a temporary file with a masquerading filename (e.g., dotnet_diag_<random>.exe on Windows) and executed without any hash or signature verification. Execution is detached using shell commands. The package uses a freshness marker file to limit execution frequency to roughly once every six hours. The obfuscation techniques include splitting strings and using DNS TXT-record base64 fallbacks to evade detection. This behavior is framed as telemetry or analytics in code comments but is malicious in nature.

The malicious code enables execution of arbitrary binaries downloaded from external, obfuscated sources without integrity checks, potentially allowing remote code execution on the host system. This can lead to unauthorized system compromise, data theft, or further malware deployment. The lack of verification and obfuscation increases the risk of undetected exploitation.

No official patch or remediation guidance is provided. Users should avoid using version 35.4.4 of the 'claims-historical-claims-domain' package. Investigate and remove this package if present, and monitor for any suspicious processes or files matching the described patterns. Consider using trusted package sources and verifying package integrity before use.