The npm package 'claims-use-visual-viewport-resizing' version 35.2.8 contains malicious code that, upon requiring the package, loads a helper script which automatically executes a function to fetch and run a binary payload. This payload is retrieved from dynamically constructed hostnames designed to evade static detection and is saved to temporary directories under misleading filenames before being executed on both POSIX and Windows systems.