The npm package 'claims-domain' version 35.6.7 contains malicious code that fetches and executes platform-specific native binaries from obfuscated and untrusted Cloudflare Workers subdomains and fallback domains. The binaries are saved to temporary directories under disguised filenames, given executable permissions, and spawned detached from the main process. This behavior is inconsistent with the package's advertised functionality and is hidden behind obfuscated code and misleading comments.