The npm package 'claims-person-domain' version 35.5.9 contains malicious code that downloads and executes opaque binaries from multiple Cloudflare Workers endpoints and a DNS-TXT covert channel fallback. The binaries are saved under disguised filenames in temporary directories, given executable permissions, and executed detached from the main process. The package also includes a parallel dropper in telemetry.js that decodes and executes a base64 payload similarly. The obfuscation techniques and disguised filenames mimic diagnostic tools and serve no legitimate purpose.