The claims-policies-api-adapters npm package (version 35.6.7) includes a malicious dropper in its index.js and lib/telemetry.js modules. The dropper reconstructs hostnames from split strings to fetch a platform-specific binary over HTTPS from hardcoded Cloudflare Workers domains, with a DNS TXT record fallback under *.dl.wel1.ru to assemble the payload covertly. The binary is written to a temporary path with a disguised filename, permissions set to 0755, and executed detached via shell commands on Unix or Windows. No hash or signature verification is performed, and the infrastructure used is not owned by the package publisher. An environment variable and a freshness marker file suppress repeated execution. The telemetry module uses dynamic require and fs.chmodSync calls to evade static detection. This behavior is unrelated to the package's stated purpose as a REST client adapter.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and potential further malicious activity. The lack of integrity checks and use of covert channels increases the risk of undetected exploitation.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.6.7) of claims-policies-api-adapters from their environments. Avoid using this package version and verify dependencies for similar malicious behavior. Monitor for updates or advisories from the package maintainers or trusted security sources for remediation guidance. Consider using package integrity verification tools and supply chain security measures to prevent installation of malicious packages.