The 'claims-is-mobile-layout' npm package version 35.4.3 includes malicious code that, upon require(), loads a vendor script which selects a platform-specific endpoint to download a native binary over HTTPS. The binary is saved to temporary directories with cover-story filenames and executed detached via shell commands. To evade static detection, destination hostnames are constructed at runtime from split string literals, and a DNS-TXT covert channel is used as a fallback to retrieve executable payloads. This malicious behavior is inconsistent with the package's stated purpose and represents a supply chain threat.

The malicious code enables execution of arbitrary native binaries on the host system, potentially allowing attackers to run unauthorized code with the privileges of the user running the Node.js process. The use of obfuscation and covert channels complicates detection and mitigation, increasing the risk of persistent compromise or further payload delivery.

No official patch or remediation guidance is provided. Users should immediately cease using version 35.4.3 of 'claims-is-mobile-layout' and remove it from their environments. Verify package integrity and source before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding this compromise. Consider using package integrity verification tools and supply chain security best practices.