MalwarePublished 5 Aug 2026

claims-payout-offer-api-adapters (npm) · Malicious Code

Affects claims-payout-offer-api-adaptersSource GCVE Database

Malicious package : remove claims-payout-offer-api-adapters and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:14 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12633

What to do

Remove claims-payout-offer-api-adapters from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-payout-offer-api-adapters	Affected =35.2.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'claims-payout-offer-api-adapters' version 35.2.2 contains malicious code that, upon import, downloads and executes a platform-specific binary from obfuscated third-party hosts. This binary is saved with deceptive filenames and executed without verification, allowing attacker-controlled code to run automatically. The malicious behavior is unconditional unless specific environment variables are set to prevent it.

Impact

Any application that installs and requires this specific version of the package will automatically execute attacker-controlled binaries, potentially leading to full system compromise or unauthorized actions on the host. The lack of verification and unconditional execution significantly increases the risk of exploitation.

Defensive guidance

Users should avoid using version 35.2.2 of this package. If already installed, remove the package and do not require it in code. Setting specific environment variables can prevent the malicious code from executing, but the exact variables are not detailed here. Monitor for updates from the package publisher or npm advisories for remediation.

Summary

The package's main entry point loads a support script that downloads a platform-specific executable from obfuscated Cloudflare Workers hostnames and fallback DNS-TXT records from unrelated domains. The binary is saved to a temporary location with misleading names and executed detached from the main process. Hostnames are dynamically reconstructed at runtime to evade static detection. There is no version pinning, hash checking, or signature verification on the downloaded executable. This fetch-and-execute chain triggers automatically on import unless mitigated by environment variables, causing any consumer requiring this package to run attacker-controlled code.

References

npmjs.com/package/claims-payout-offer-api-adapters/v/35.2.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:14 UTC

Technical details

References

Community reviews