claims-api-clients-shared@35.1.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution under the importing process's privileges.

Remote binary download/DNS staging followed by detached execution.

The public entrypoint silently loads _shim.js. Its top-level main() runs on import, obtains a platform-specific binary from hard-coded worker hosts or DNS TXT records, writes it to /var/tmp or Windows Temp, marks it executable on Unix, and launches it detached through a shell or cmd.exe. The state stamp merely throttles repeat execution.

This is an import-time staged remote payload execution chain unrelated to the stated REST client wrapper. The absence of lifecycle hooks does not mitigate execution on normal use.