The npm package claims-get-indexed-selector version 35.8.7 contains malicious code that executes a binary dropper upon module load. It downloads a native binary from attacker-controlled hosts, writes it to temporary locations with misleading filenames, sets executable permissions, and runs it detached. If HTTPS download fails, it uses a covert DNS-TXT channel to retrieve the binary in chunks. No integrity verification is performed on the downloaded binary. The package masquerades as a benign runtime support module, but the delivered binary is opaque and potentially harmful.