The npm package 'claims-jira-service' version 35.8.3 contains malicious code that, when required, downloads and executes a platform-specific executable from attacker-controlled hosts. The payload is fetched using obfuscated hostnames and a DNS TXT record fallback, written to temporary files with disguised names, given execute permissions, and run detached from the main process. Execution is throttled using a benignly named stamp file. The obfuscation techniques include string splitting to evade static analysis and covert data transport via DNS TXT chunking.