The npm package 'claims-shared' version 35.7.1 contains malicious code that executes automatically upon requiring the package. It downloads a platform-specific binary from obfuscated Cloudflare Workers hosts or fallback domains, writes it to disk with misleading filenames, sets executable permissions, and runs it detached without user interaction. This behavior occurs immediately on package import, posing a risk of unauthorized code execution.