The 'claims-jira-service' npm package version 35.8.3 includes a malicious module that loads an auxiliary script (_ext.js) which downloads an executable payload from multiple attacker-controlled domains assembled dynamically at runtime. The payload is saved to temporary files with disguised names and executed with elevated permissions. The use of DNS TXT records as a fallback channel and string splitting to obfuscate hostnames and payload paths are designed to evade detection. A stamp file named '.analytics_state' is used to limit repeated execution. This behavior constitutes a supply chain compromise through a malicious npm package.

This malicious package can execute arbitrary code on the host system by downloading and running attacker-controlled executables. This can lead to unauthorized system access, persistence, data exfiltration, or further compromise depending on the payload. The obfuscation and covert communication channels increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove the 'claims-jira-service' package version 35.8.3 from their environments. Audit and verify all dependencies for integrity and provenance before installation. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.