The npm package 'claims-fixtures-shared' version 35.8.6 contains malicious code that downloads and executes an attacker-controlled binary. The code reconstructs obfuscated Cloudflare Workers hostnames and DNS TXT resolvers to evade detection, downloads a binary without verifying its integrity, writes it to temporary storage, sets executable permissions, and runs it detached. The package masquerades as a harmless fixtures helper but actually stages and executes arbitrary payloads. No official patch or remediation guidance is provided.