claims-domain@35.6.7

High-risk behavior combination matched malicious policy.

Runtime import of claims-domain via index.js.

Arbitrary remote native code executes with the importing process's privileges.

Import-time staged payload download, drop, chmod, and detached execution.

Importing index.js silently requires _ext.js, which immediately calls init(). It contacts obfuscated worker hosts for a platform-specific binary, with DNS TXT chunk retrieval from wel1.ru as fallback. A received payload is written to a temporary directory, made executable on Unix, and launched detached through /bin/sh or cmd.exe. The marker file and swallowed errors reduce visibility and repeat execution only after a TTL.

This is a concrete, import-triggered remote binary execution chain unrelated to the documented claims wrapper. The dormant telemetry module mirrors the same loader design but is not required for the confirmed attack.