The 'claims-should-retry' npm package (version 35.6.8) loads a platform-specific binary by reconstructing obfuscated destination hosts from split string arrays to evade static inspection. It downloads the binary, writes it to temporary directories with misleading names (e.g., dotnet_diag_*.exe), sets executable permissions, and spawns it detached with ignored stdio. If the HTTP fetch fails, it falls back to a covert DNS-TXT channel that enumerates and base64-decodes TXT records from specially crafted subdomains to reconstruct and execute the payload. The package suppresses re-execution via marker files and disables telemetry and logging to conceal its behavior. Despite being advertised as a claims-retry library, it performs unauthorized binary execution.

This malicious package can execute arbitrary platform-specific binaries on the host system, potentially leading to full system compromise or unauthorized actions. The use of obfuscation and covert DNS channels complicates detection and analysis. The suppression of telemetry and logging further hinders incident response efforts.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.6.8) of the 'claims-should-retry' package from their environments. Avoid installing or using this package until a trusted, verified version is available. Monitor for unexpected child processes spawned by this package and network connections to suspicious domains such as *.dl.wel1.ru. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.