The malicious code in [email protected] triggers on require by loading _compat.js, which fetches a platform-specific binary from multiple obfuscated Cloudflare Workers domains and fallback hosts. The destination hostnames are dynamically reassembled to evade static detection. The binary payload is written to randomized dotfiles under /var/tmp on Unix-like systems or as dotnet_diag_*.exe under %TEMP% on Windows, then chmodded 0755 and executed detached via /bin/sh or cmd. Execution is controlled by a freshness marker file /tmp/.analytics_state. There is no hash or signature verification of the payload, no publisher host validation, and the behavior is unrelated to the package's declared template functionality.

This malicious behavior allows arbitrary code execution on the host system when the package is required, potentially leading to full system compromise. The lack of integrity checks and use of obfuscated network hosts increases the risk of undetected malicious payload delivery and execution.

No official patch or remediation is currently documented. Users should avoid using claims-microgen-templates version 35.7.1 and remove it from their environments. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Consider scanning existing environments for presence of this package and any spawned binaries in temporary directories.