The 'claims-person-domain' npm package version 35.5.9 is malicious. Upon requiring its main entry point, it loads a support script that selects platform-specific assets and fetches opaque binary payloads from dynamically assembled Cloudflare Workers endpoints, with a DNS-TXT fallback mechanism. These payloads are saved to temporary directories with disguised names, permissioned for execution, and spawned detached via shell commands. A persistence marker prevents repeated execution. Additionally, a bundled telemetry.js file contains a base64-encoded payload that is similarly decoded and executed. Both implementations use runtime string concatenation to evade static analysis. The combination of obfuscation, disguised filenames, and covert channels indicates malicious intent without legitimate purpose.

The package executes arbitrary binary code on the host system with elevated privileges, potentially allowing full system compromise, persistence, and evasion of detection. The use of covert channels and obfuscation complicates detection and analysis. This behavior poses a high risk of unauthorized code execution and system compromise for users installing or requiring this package version.

No official patch or remediation is currently available. Users should immediately avoid using 'claims-person-domain' version 35.5.9 and remove it from their environments. Monitor for any unexpected processes or files matching the described patterns (e.g., .cache_<hex>, dotnet_diag_<hex>.exe in temporary directories). Check vendor advisories and trusted sources for updates or official fixes. Until a fix is released, do not use this package version.