claims-historical-claims-domain@35.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of claims-historical-claims-domain

Arbitrary attacker-controlled native code executes under the importing process's user account.

import-time remote binary download, drop, chmod, and detached execution

Loading index.js silently imports _bridge.js. Its import-time main routine downloads a platform-specific binary from obfuscated worker hosts, falling back to DNS TXT reconstruction from platform-specific domains. It writes the bytes under /var/tmp or the Windows temp directory, makes non-Windows files executable, and starts them detached via /bin/sh or cmd.exe.

This is a concrete import-time remote payload execution chain, not telemetry. The large telemetry file contains the same payload-hosting primitive, while _bridge.js makes it immediately reachable.