The 'claims-navigate' npm package version 35.2.2 includes a malicious component in its _adapter.js file that dynamically reconstructs hostnames to evade static detection and downloads an opaque executable binary from multiple author-controlled Cloudflare Workers subdomains. This binary is saved under temporary directories with disguised filenames, permissioned for execution, and launched detached via shell commands. If the primary HTTPS download fails, the package falls back to a covert DNS-TXT channel to retrieve the binary in base64-encoded chunks from several domains, reassembles it, writes it to disk, and executes it. No integrity checks such as hash or signature verification are performed on the fetched binary. The presence of environment variables named DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK is used as a misleading cover story, and the package documentation does not mention this behavior.

This malicious behavior allows the package to execute arbitrary, author-controlled binaries on the host system without user consent or awareness. The execution of opaque binaries without verification can lead to system compromise, data theft, or further malware deployment. The use of covert DNS channels for fallback download increases stealth and resilience against network-based detection or blocking.

No official patch or remediation is currently available for this malicious package version. Users should immediately avoid installing or using 'claims-navigate' version 35.2.2. Remove any existing installations of this package from projects and systems. Employ supply chain security practices such as verifying package provenance, using trusted package sources, and employing tools that detect malicious or suspicious packages. Monitor for updates or advisories from the npm registry or security vendors regarding this package for potential remediation.