The 'claims-policy-details-domain' npm package at version 35.9.3 loads a _vendor.js script that downloads platform-specific binaries from obfuscated Cloudflare workers.dev subdomains. It employs a DNS TXT record covert channel fallback under *.dl.wel1.ru to retrieve base64-encoded payload chunks via DNS resolveTxt queries. These payloads are reconstructed, saved to disguised paths in temporary directories (e.g., /var/tmp or %TEMP%), permissions are set to executable (chmod 755), and the binaries are spawned detached using shell commands. The package assembles command-and-control hostnames from split string fragments to evade static analysis and uses environment variables and caching to reduce detection. It masquerades as an internal SDK at a high version number with minimal legitimate code, consistent with a dependency confusion attack vector whose primary function is to drop and execute malicious binaries.

This malicious package can lead to arbitrary code execution on affected systems by downloading and running unauthorized binaries. The use of covert DNS channels and obfuscated C2 hostnames complicates detection and analysis. Systems that install this package version risk compromise through execution of potentially harmful payloads, which could facilitate further malicious activities depending on the dropped binaries.

No official patch or fix is currently documented for this malicious package version. Users should avoid installing or using 'claims-policy-details-domain' version 35.9.3. Audit and remove this package if present in your environment. Employ supply chain security best practices such as verifying package provenance and using trusted registries. Monitor for suspicious network activity related to Cloudflare workers.dev subdomains and DNS TXT queries to *.dl.wel1.ru domains. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.