The npm package 'claims-policy-details-api-adapters' version 35.3.1 contains malicious code that, upon requiring the package, downloads a platform-specific binary from obfuscated and suspicious hosts. This binary is saved to temporary directories under covert filenames, made executable, and executed detached from the main process. The package uses a DNS-TXT record-based covert channel to retrieve the binary in chunks, bypassing typical URL and domain egress controls. No integrity verification of the downloaded binary is performed despite comments referencing SHA-256, increasing the risk of executing untrusted code.