The npm package claims-policies-api-adapters version 35.6.7 contains malicious code that downloads and executes a platform-specific binary from unauthorized Cloudflare Workers hosts. The binary is fetched using obfuscated hostname reconstruction and a covert DNS TXT record fallback channel. It is saved to a temporary location, given executable permissions, and spawned detached without any integrity verification. The package also includes a secondary module with similar dropper behavior designed to evade static analysis. This malicious behavior is unrelated to the package's advertised functionality as a REST client adapter.