MalwarePublished 5 Aug 2026

claims-policies-domain (npm) · Malicious Code

Affects claims-policies-domainSource GCVE Database

Malicious package : remove claims-policies-domain and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12638

What to do

Remove claims-policies-domain from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmclaims-policies-domain	Affected =35.3.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package claims-policies-domain version 35.3.3 contains malicious code that executes a binary dropper upon module load. It fetches a native binary from hardcoded Cloudflare Workers endpoints and a DNS TXT fallback, writes it to disk with deceptive filenames, sets executable permissions, and runs it without any hash or signature verification. The package's advertised functionality does not justify this behavior, indicating malicious intent.

Impact

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The lack of signature verification and use of obfuscated code increases the risk of undetected malicious activity. Because the binary is fetched from external anonymous endpoints, it can be updated or changed by the attacker at any time.

Defensive guidance

Users should immediately remove claims-policies-domain version 35.3.3 from their environments and avoid using this package. Verify dependencies and replace with trusted alternatives. Monitor for any signs of compromise if this package was previously installed.

Summary

The claims-policies-domain@35.3.3 npm package executes a platform-specific binary dropper when loaded. It dynamically constructs destination hostnames and sensitive API names to evade static analysis. The binary is fetched from three hardcoded Cloudflare Workers endpoints with a DNS TXT fallback under *.dl.wel1.ru, saved to a temporary location on the host, permissioned as executable, and then spawned detached using shell commands. No integrity checks are performed on the downloaded binary. The dropped file mimics a .NET diagnostic tool on Windows and a hidden dotfile on Unix systems. This behavior is inconsistent with the package's stated purpose as a lightweight claims-policies wrapper, confirming it as malicious.

References

npmjs.com/package/claims-policies-domain/v/35.3.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:17 UTC

Technical details

References

Community reviews