The claims-replace-url-params npm package version 35.3.2 includes a no-op public API that triggers the loading of an internal adapter module. This adapter downloads executable code over HTTPS from hardcoded workers.dev domains with a DNS-TXT fallback mechanism that assembles base64 chunks from dl.wel1.ru subdomains. The downloaded payload is saved to temporary locations on Unix or Windows systems, permissions are set to executable, and the payload is spawned as a detached process using shell commands. Hostnames and module names are constructed dynamically at runtime to evade static string detection. The package performs no hash or signature verification on the fetched payloads, and the external hosts have no legitimate relation to the package's stated functionality, indicating malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running unverified payloads from attacker-controlled servers. This can lead to system compromise, unauthorized actions, or persistence mechanisms being installed. The lack of integrity checks and obfuscation techniques increase the risk of undetected exploitation. However, there are no known exploits in the wild reported at this time.

No official patch or remediation is currently documented. Users should immediately remove version 35.3.2 of claims-replace-url-params from their environments and avoid using this package until a trusted, clean version is available. Conduct a thorough investigation for any signs of compromise if this package was installed. Monitor for updates from the package maintainers or security advisories for remediation guidance. Since no patch is confirmed, rely on removal and avoidance as primary mitigation.