claims-policies-domain@35.3.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Importing/requiring claims-policies-domain

Arbitrary remote code executes as the importing user's process.

remote binary download, drop, chmod, and detached execution

index.js silently requires _platform.js during ordinary package import. That module fetches a platform-specific binary from rotating workers.dev hosts or reconstructs it from DNS TXT records on wel1.ru domains, writes it to a temp path, changes Unix permissions to executable, and starts it through a detached shell or cmd.exe process. Its telemetry implementation contains a matching configurable download-and-execute extension mechanism.

The claimed domain wrapper has no legitimate connection to import-time remote binary execution. This is a concrete remote payload execution chain, not a scanner-only inference.