The npm package claims-handle-api-response version 35.4.9 contains malicious code that acts as a malware dropper. On loading, it downloads and executes opaque binaries from anonymous Cloudflare Workers hosts or, if that fails, via a DNS-TXT covert channel. The binaries are staged in temporary directories with disguised filenames and executed detached from the main process. This behavior is unrelated to the advertised REST client functionality and is characteristic of malware delivery infrastructure.