The npm package 'claims-should-retry' version 35.6.8 contains malicious code that downloads and executes platform-specific binaries under misleading filenames. It uses obfuscated domain reconstruction to evade static detection and employs a DNS-TXT record covert channel as a fallback to retrieve executable payloads. The package suppresses telemetry and console output to hide its activity. It is advertised as a claims-retry library but performs unauthorized code execution.