The npm package 'claims-policy-details-domain' version 35.9.3 contains malicious code that downloads and executes platform-specific binaries from anonymous Cloudflare worker subdomains. It uses a DNS TXT record covert channel fallback to retrieve payload chunks, which are then saved to temporary directories and executed with elevated permissions. The package is likely a dependency confusion lure with minimal legitimate functionality, designed primarily as a dropper for malicious payloads.