The npm package 'claims-create-client-validator' version 35.8.9 contains malicious code that downloads and executes an OS/architecture-specific native binary from obfuscated and dynamically constructed remote hosts. This binary is saved to temporary directories with disguised filenames and executed without integrity verification. The malicious behavior is only disabled if certain environment variables indicating telemetry opt-out are set. The package falsely advertises itself as a claims validator with no legitimate need for native code execution at import time.