The npm package 'claims-person-api-adapters' version 35.2.4 contains malicious code that executes on import. It reconstructs obfuscated network destinations to download and execute attacker-controlled binaries without verification. The payload is saved under misleading filenames and executed detached on the host system, enabling remote code execution. This behavior is hidden behind a seemingly benign package name and uses evasion techniques such as URL reconstruction and DNS-TXT fallback channels.