The 'claims-person-api-adapters' npm package version 35.2.4 includes malicious functionality triggered upon requiring the package. Its index.js loads _ext.js, which reconstructs obfuscated URLs pointing to Cloudflare Workers and fallback domains unrelated to the legitimate publisher. It downloads a binary payload via HTTPS, saves it to temporary directories with cover-story filenames, sets executable permissions, and executes it detached using platform-specific shell commands. No integrity checks (hash or signature verification) are performed on the downloaded payload. The obfuscation and fallback mechanisms serve as evasion techniques rather than legitimate delivery methods. The package's sole observed effect is to retrieve and run attacker-controlled code on the host, representing a supply chain compromise.

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary code with the privileges of the user installing the package. The lack of payload verification and use of obfuscation techniques increase the risk of undetected compromise. The execution of attacker-controlled binaries can lead to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.2.4 of 'claims-person-api-adapters' from their environments and avoid installing or importing this package. Verify package integrity and source authenticity before installation. Monitor for updates or advisories from trusted sources regarding remediation or replacement packages. Employ supply chain security best practices such as using package signing and trusted registries.