The 'claims-payout-offer-api' npm package version 35.7.6 includes malicious code embedded in its index.js and lib/telemetry.js files. These scripts reconstruct C2 hostnames from split fragments to avoid static detection and use DNS-TXT base64 fallback channels for communication. The malicious code downloads platform-specific payloads via HTTPS, writes them to disk under disguised names (e.g., 'dotnet_diag_*.exe' on Windows, '.cache_*' in /var/tmp on Unix), changes file permissions to executable, and spawns these payloads detached using shell commands. The package's advertised purpose as a REST client wrapper does not require any such behavior, indicating deliberate malicious intent.

This malicious package can lead to arbitrary code execution on the host system by downloading and running unauthorized payloads. The dropped payloads run detached from the main process, potentially enabling persistent and stealthy compromise. This can result in system takeover, data exfiltration, or further malware deployment depending on the payload delivered by the C2 servers.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.7.6 of 'claims-payout-offer-api' from their projects and replace it with a trusted alternative or a clean version if available. Avoid using this package from untrusted sources and verify package integrity before installation. Monitor for any unexpected network connections to the described C2 domains and investigate systems where this package was installed.