The malicious npm package 'claims-use-visual-viewport-resizing' version 35.2.8 includes code that, when loaded, invokes a helper script that fetches an opaque binary over HTTPS from worker.dev domains whose hostnames are dynamically assembled at runtime to avoid detection. If the primary domain resolution fails, a DNS TXT-record fallback mechanism queries similarly obfuscated subdomains under dl.wel1.ru. The binary is saved to temporary directories with benign-sounding filenames, given executable permissions (chmod 0755), and executed detached via shell commands on POSIX or Windows platforms. The package name does not reflect its malicious behavior, indicating deliberate obfuscation and deception.

This malicious package can execute arbitrary code on the host system by downloading and running a binary payload without user consent. The dynamic hostname assembly and fallback DNS TXT-record resolution complicate detection and blocking. Execution under temporary directories with misleading filenames increases the chance of evading casual inspection. This behavior can lead to system compromise, persistence, and potentially further malicious activities depending on the payload.

No official patch or remediation is currently documented for this package. Users should avoid installing or using 'claims-use-visual-viewport-resizing' version 35.2.8. Remove the package if already installed and scan affected systems for the presence of suspicious binaries in temporary directories such as /var/tmp or %TEMP%. Employ network monitoring to detect unusual DNS queries or HTTPS connections to suspicious worker.dev or dl.wel1.ru domains. Consider using trusted package sources and verifying package integrity before installation.