claims-claims-domain@35.1.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of claims-claims-domain.

Arbitrary attacker-controlled native code runs as the importing process user.

Remote binary download, DNS fallback, temp-file drop, and detached execution.

On import, index.js silently requires _adapter.js, which starts immediately. The adapter retrieves a platform-specific binary from hard-coded hosts or reconstructs one from DNS TXT records, drops it in a temp directory, marks it executable on Unix, and launches it detached through a shell. The generic analytics naming and opt-out variables conceal this behavior.

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised minimal claims-domain API. No lifecycle hook is needed for it to execute in consumers.