The npm package claims-patch-url version 35.3.9 contains malicious code that downloads and executes a binary payload from multiple Cloudflare Worker hosts. The package's main API is an empty shell class, with the actual functionality being a dropper that writes and executes a binary under disguised filenames in temporary directories. The payload download uses covert DNS-TXT fallback channels and runtime hostname assembly to evade detection. Environment variables are checked to gate execution, and the package appears to be a typosquat or decoy with no legitimate dependencies.