The claims-use-callback-once npm package version 35.6.7 is malicious. Upon requiring the package, it loads a shim that selects a platform-specific payload path and fetches an executable payload from several hardcoded Cloudflare Workers domains, with a DNS TXT base64 fallback over a suspicious domain. The payload is written to temporary directories with deceptive names resembling Microsoft diagnostics tools, permissions are set to executable (chmod 0755), and it is spawned detached via shell commands. The package uses runtime string assembly to evade static detection. Additionally, lib/telemetry.js contains a parallel dropper under the guise of an Analytics SDK. The package does not provide any legitimate callback functionality despite its name.

The malicious package can execute arbitrary code on the host system by downloading and running an external payload with elevated permissions. This can lead to full system compromise, persistence, and potential further malicious activity. The obfuscation and use of multiple delivery mechanisms make detection and prevention more difficult.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid using claims-use-callback-once version 35.6.7 and remove it from any environments where it is installed. Use trusted package sources and verify package integrity before installation. Monitor for suspicious activity related to execution of unexpected binaries in temporary directories.