claims-navigate@35.2.2

High-risk behavior combination matched malicious policy.

Any Node.js require/import of claims-navigate, via index.js.

Arbitrary native code execution as the importing process user.

import-time remote payload download, temp-file drop, chmod, and detached execution

Requiring index.js loads _adapter.js, which executes main immediately. It fetches a platform-specific binary from obfuscated Workers hosts or reconstructs it from DNS TXT records, writes it under a temporary randomized name, sets executable permissions on Unix, and starts it through a detached shell or cmd.exe process. The payload has no integrity verification and the process suppresses errors/output.

This is a concrete import-time staged-payload execution chain, not ordinary telemetry: unverified remote bytes are silently executed detached. The package has no lifecycle hook, but normal runtime import is sufficient to trigger compromise.