claims-auth-domain@35.5.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of claims-auth-domain.

Arbitrary attacker-controlled native code can execute under the importing process account.

Remote payload download, temporary-file drop, and detached shell execution.

Loading index.js silently requires _vendor.js. Its asynchronous run function retrieves a platform-specific opaque binary from rotating HTTPS hosts or DNS TXT chunks, writes it into a temp directory, marks it executable on Unix, and starts it through a detached shell or cmd.exe process. The package gives callers no consent or legitimate need for this behavior.

This is a concrete import-time remote-code-execution chain, unrelated to the advertised token manager. No install hook is needed because normal use triggers the payload loader.