The claims-patch-url npm package at version 35.3.9 includes an empty shell class and unconditionally requires a compatibility module that downloads an opaque binary payload from one of four Cloudflare Worker hosts, with a DNS-TXT resolveTxt fallback under a suspicious domain. The payload is saved to temporary directories with benign-looking filenames, permissions are set to executable, and it is spawned detached via shell commands. The command-and-control hostnames are dynamically reassembled at runtime to evade static analysis. The package's declared API is non-functional, consistent with a malicious typosquat or decoy designed to drop and execute malware.

This malicious package can lead to arbitrary code execution on systems that install and run it, potentially allowing attackers to execute undetected binaries with the permissions of the user running the npm process. The use of covert channels and runtime obfuscation techniques increases the difficulty of detection and analysis.

No official patch or remediation is indicated. Users should avoid installing claims-patch-url version 35.3.9 and remove it if present. Since this is a malicious package likely distributed via typosquatting, verify package names carefully before installation. Monitor for and block network connections to the identified Cloudflare Worker hosts and the suspicious domain *.dl.wel1.ru. Employ runtime protection to detect and prevent execution of unexpected binaries in temporary directories.