The npm package claims-claims-api-adapters version 35.7.9 contains malicious code that, upon loading, downloads and executes a platform-specific binary from obfuscated anonymous worker domains or via a covert DNS-TXT channel. The binary is saved with stealth filenames and executed without any hash or signature verification, enabling covert execution of potentially harmful payloads.