The npm package claims-accounts-lib version 35.6.6 contains malicious code that automatically downloads and executes attacker-controlled binaries upon being required. It uses obfuscated techniques to evade detection, including rotating HTTPS endpoints and a DNS-TXT covert channel to fetch payloads without verification. This behavior results in arbitrary code execution on the host system.