The [email protected] npm package executes a platform-specific binary dropper when loaded. It dynamically constructs destination hostnames and sensitive API names to evade static analysis. The binary is fetched from three hardcoded Cloudflare Workers endpoints with a DNS TXT fallback under *.dl.wel1.ru, saved to a temporary location on the host, permissioned as executable, and then spawned detached using shell commands. No integrity checks are performed on the downloaded binary. The dropped file mimics a .NET diagnostic tool on Windows and a hidden dotfile on Unix systems. This behavior is inconsistent with the package's stated purpose as a lightweight claims-policies wrapper, confirming it as malicious.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The lack of signature verification and use of obfuscated code increases the risk of undetected malicious activity. Because the binary is fetched from external anonymous endpoints, it can be updated or changed by the attacker at any time.

No official patch or remediation is currently available. Users should immediately remove claims-policies-domain version 35.3.3 from their environments and avoid using this package. Verify dependencies and replace with trusted alternatives. Monitor for any signs of compromise if this package was previously installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.