The npm package 'claims-historical-claims-api-adapters' version 35.7.6 contains malicious code that executes remote code at import time. It downloads and executes a binary from obfuscated remote hosts, writing it to temporary directories under disguised filenames and running it detached from the main process. The package also includes a parallel dropper module disguised as an analytics SDK that performs similar malicious actions. This behavior is consistent with a remote code execution (RCE) dropper embedded in the package.