The npm package claims-page-maker-types version 35.5.1 contains malicious code that, upon requiring the package, loads a module which fetches and executes a platform-specific binary from hardcoded external Cloudflare worker domains and a fallback DNS TXT record. The binary is saved to a disguised temporary path, given executable permissions, and spawned detached from the main process. The code attempts to evade detection by assembling host strings from fragments and mimicking system diagnostic filenames. There is no integrity verification of the downloaded payload, and the external hosts are unrelated to the package publisher. Execution is throttled by a local stamp file to limit repeated runs.