claims-payout-offer-domain@35.6.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of claims-payout-offer-domain.

Arbitrary native code execution in the importing user's environment.

Remote payload download, temp-file drop, and detached shell execution.

Requiring index.js silently requires _vendor.js. Its bootstrap fetches a >1 KB platform-specific payload from obfuscated endpoints, or reconstructs one from DNS TXT records. It stores the payload in a temp directory, marks it executable on Unix, then launches it detached through /bin/sh or cmd.exe. A timestamp file throttles repeats and exceptions are suppressed.

This is a confirmed import-time downloader-and-executor, not ordinary telemetry. No lifecycle hook is needed because the package entrypoint activates it.