The npm package claims-to-iso-string-with-timezone (version 35.7.2) includes a malicious payload embedded in its _init.js file, which is loaded by index.js. Upon requiring the package, it reconstructs URLs from obfuscated string arrays to download a platform-specific binary from Cloudflare Workers hostnames and a DNS-TXT fallback domain. The binary is written to temporary directories such as /tmp/.cache_<random> on Unix or %TEMP%\dotnet_diag_<random>.exe on Windows, given executable permissions, and then spawned detached via shell commands. The binary name impersonates legitimate dotnet diagnostic tooling to evade detection. The malicious code is wrapped in try/catch blocks to suppress errors, making the malicious activity stealthy. The package name resembles a legitimate date/timezone formatting utility, misleading users about its true intent.

The malicious package can execute arbitrary code on the host system by downloading and running a hidden binary, potentially leading to system compromise. The dropped binary runs detached from the main process, which may evade some detection mechanisms. The impersonation of legitimate tooling may delay suspicion. No specific exploit in the wild is currently known, but the presence of such a dropper indicates a high risk of unauthorized code execution and persistence.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove claims-to-iso-string-with-timezone version 35.7.2 from their projects and dependency trees. Avoid installing or using this package. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unexpected binaries named similarly to dotnet diagnostic tools in temporary directories and investigate accordingly. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.