The 'claims-shared' npm package version 35.7.1 includes a malicious payload triggered by requiring the package. The index.js file loads a polyfill script that fetches a binary from a shuffled list of Cloudflare Workers subdomains or fallback DNS TXT chunked downloads from suspicious Russian subdomains. The binary is reconstructed from split strings to evade detection, saved to temporary directories with cover-story filenames, made executable, and executed detached via shell or command prompt. Execution only proceeds if the payload exceeds 1000 bytes. This occurs without any explicit user action beyond requiring the package.

This malicious behavior allows arbitrary code execution on the host system immediately upon importing the package, potentially leading to system compromise, data theft, or further malware deployment. Since the payload executes detached and silently, it can evade casual detection and persist unnoticed.

No official patch or remediation is currently documented. Users should avoid using the 'claims-shared' package version 35.7.1. Investigate and remove this package from projects and systems. Monitor for unexpected processes or files matching the described behavior. Check vendor advisories or trusted sources for updates or fixes.