claims-handle-api-response@35.4.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime import/require of claims-handle-api-response.

Arbitrary attacker-controlled native code can execute under the importing process's user account.

remote binary download/DNS payload recovery followed by detached execution

The main entrypoint silently loads setup.js. That module fetches a platform-specific payload from concealed HTTPS hosts, falls back to base64 data retrieved through DNS TXT records, writes the result under a randomized temporary filename, grants execute permission on non-Windows systems, and launches it detached through a shell or cmd.exe.

This is an import-time remote code execution chain unrelated to the stated API-client purpose. The lack of an npm lifecycle hook does not mitigate execution on ordinary package import.