The npm package 'claims-get-percentage-value' version 35.4.6 contains malicious code that downloads and executes a platform-specific binary from hardcoded remote hosts. This binary is saved to temporary directories with misleading filenames and executed without any integrity verification. The package uses environment variable checks and naming conventions to disguise this behavior as telemetry-related activity, which is unrelated to its advertised functionality.