The npm package 'claims-payout-offer-domain' version 35.6.1 contains malicious code that, upon being required, downloads and executes an opaque binary payload from obfuscated external sources. The payload is fetched without integrity verification and executed with elevated permissions, potentially compromising the host system.