The npm package 'claims-historical-claims-domain' version 35.4.4 contains malicious code that, upon require, downloads a binary from obfuscated external URLs and executes it without verification. The binary is saved to a temporary file with a disguised name and executed detached from the main process. This behavior is disguised as telemetry or analytics and is gated to run approximately once every six hours. No patch or remediation guidance is provided.