The npm package 'claims-payout-offer-api-adapters' version 35.2.2 contains malicious code that, upon import, downloads and executes a platform-specific binary from obfuscated third-party hosts. This binary is saved with deceptive filenames and executed without verification, allowing attacker-controlled code to run automatically. The malicious behavior is unconditional unless specific environment variables are set to prevent it.