The npm package 'claims-block-visibility' version 35.3.8 contains malicious code that executes automatically upon module load. It downloads and executes attacker-controlled native binaries from obfuscated and fallback DNS-based channels. This behavior results in silent execution of potentially harmful code on the host system without user consent.