The claims-use-base-analytics package version 35.4.9 acts as a native-binary dropper. Upon requiring the package, it loads a shim that selects a platform-specific binary fetched over HTTPS from attacker-controlled Cloudflare Workers domains. The binary is saved to temporary directories with disguised names, permissioned, and executed detached from the parent process. If HTTPS fetching fails, the package uses a DNS-over-TXT covert channel to reassemble a base64-encoded payload from TXT DNS records under attacker domains, bypassing HTTP egress filtering. Hostnames are obfuscated via string splitting, and child process spawning is dynamically constructed to evade static analysis. Execution is rate-limited by a ~6-hour TTL cache, and environment variables DISABLE_TELEMETRY and DO_NOT_TRACK are honored to appear benign. The package's malicious behavior is inconsistent with its stated analytics purpose.

This package enables remote attackers to execute arbitrary native binaries on affected systems, potentially leading to full system compromise. The use of covert DNS channels and obfuscation techniques complicates detection and prevention. The malicious payload can be executed repeatedly but is rate-limited to once every six hours. The presence of this package in a project introduces a high risk of unauthorized code execution and persistence.

No official patch or remediation is currently documented. Users should immediately remove [email protected] from their projects and dependency trees. Audit systems for the presence of the package and any suspicious binaries in temporary directories. Block network access to the identified attacker-controlled domains and monitor DNS TXT queries for suspicious activity. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages.