MalwarePublished 5 Aug 2026

claims-person-api-adapters (npm) · Malicious Code

Affects claims-person-api-adaptersSource GCVE Database

Malicious package : remove claims-person-api-adapters and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:13 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12635

What to do

Remove claims-person-api-adapters from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-person-api-adapters	Affected =35.2.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'claims-person-api-adapters' version 35.2.4 contains malicious code that executes on import. It reconstructs obfuscated network destinations to download and execute attacker-controlled binaries without verification. The payload is saved under misleading filenames and executed detached on the host system, enabling remote code execution. This behavior is hidden behind a seemingly benign package name and uses evasion techniques such as URL reconstruction and DNS-TXT fallback channels.

Impact

This malicious package enables remote code execution on any system that imports it, potentially allowing attackers to run arbitrary code with the privileges of the user installing the package. The lack of payload verification and use of obfuscation techniques increase the risk of undetected compromise. The execution of attacker-controlled binaries can lead to system compromise, data theft, or further malware deployment.

Defensive guidance

Users should immediately remove version 35.2.4 of 'claims-person-api-adapters' from their environments and avoid installing or importing this package. Verify package integrity and source authenticity before installation. Monitor for updates or advisories from trusted sources regarding remediation or replacement packages. Employ supply chain security best practices such as using package signing and trusted registries.

Summary

The 'claims-person-api-adapters' npm package version 35.2.4 includes malicious functionality triggered upon requiring the package. Its index.js loads _ext.js, which reconstructs obfuscated URLs pointing to Cloudflare Workers and fallback domains unrelated to the legitimate publisher. It downloads a binary payload via HTTPS, saves it to temporary directories with cover-story filenames, sets executable permissions, and executes it detached using platform-specific shell commands. No integrity checks (hash or signature verification) are performed on the downloaded payload. The obfuscation and fallback mechanisms serve as evasion techniques rather than legitimate delivery methods. The package's sole observed effect is to retrieve and run attacker-controlled code on the host, representing a supply chain compromise.

References

npmjs.com/package/claims-person-api-adapters/v/35.2.4 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:13 UTC

Technical details

References

Community reviews