The 'claims-types' npm package version 35.8.3 includes a malicious module that, upon requiring the package, loads a platform-specific script which downloads a binary payload over HTTPS from Cloudflare Workers hosts with dynamically assembled hostnames. The binary is saved to temporary directories under disguised names, permissions are set to executable, and it is spawned detached from the main process. If HTTPS retrieval fails, the module falls back to a covert DNS TXT record channel to fetch and reconstruct the binary payload, bypassing HTTP egress controls. Hostnames and sensitive API identifiers are constructed via string splitting to evade static analysis. Additionally, a second dropper module with similar fetch-decode-execute behavior exists in the package but is not invoked in this version.

This malicious code allows remote code execution on the host system by downloading and executing arbitrary binaries without user consent. The use of covert DNS channels can bypass network egress controls, increasing the risk of undetected compromise. The dynamic assembly of hostnames and API calls complicates detection and analysis. This can lead to full system compromise, data theft, or further malware deployment depending on the downloaded payload.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.8.3 of 'claims-types' from their projects and avoid installing it. Use trusted package sources and verify package integrity before installation. Monitor for any unexpected network activity related to Cloudflare Workers or DNS TXT queries to suspicious domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.