The 'claims-policy-details-api-adapters' npm package version 35.3.1 includes malicious functionality where its index.js loads a loader script that downloads a platform-specific binary from multiple obfuscated hosts. The binary is fetched via a covert DNS-TXT chunked base64 channel that circumvents URL/domain egress restrictions. The downloaded binary is saved to temporary directories with disguised filenames, permissions are set to executable, and it is spawned detached using a shell command. Hostnames are dynamically assembled from split arrays, and no cryptographic verification of the binary is performed, despite comments mentioning SHA-256 integrity. This behavior enables stealthy execution of potentially harmful code on the host system.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution, persistence, and evasion of network security controls due to the covert DNS-based download channel. The lack of integrity checks increases the risk of executing tampered or malicious payloads. No known exploits in the wild are reported yet.

No official patch or remediation is currently available for this malicious package. Users should avoid using version 35.3.1 of 'claims-policy-details-api-adapters' and remove it from their environments if present. Employing strict package source verification and using trusted package registries can help prevent installation of such malicious packages. Monitor for suspicious activity related to temporary executable files and unexpected network DNS queries to suspicious domains.