If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08)
claims-patch-url@35.3.9 presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./_compat.js on load. On require(), _compat.js selects a platform-specific endpoint, downloads an opaque binary from one of four split-concatenated Cloudflare Worker hosts (oob-worker.cf100-*.workers.dev through oob-worker.cf103-*.workers.dev) with a DNS-TXT resolveTxt covert-channel fallback under *.dl.wel1.ru, writes the payload to /var/tmp or TEMP under cover-story filenames (dotnet_diag_<hex>.exe,.cache_<hex>,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. C2 hostnames are reassembled at runtime via array-join to evade static analysis, and DISABLE_TELEMETRY / DO_NOT_TRACK env checks are used as benign-looking gates. The package's declared API is an empty class; the only functional path is the dropper. Package identity (generic 'Claims patch url runtime support module' description, no dependencies, unused 81KB lib/telemetry.js sibling) is consistent with a typosquat/decoy.