The 'checkout-dolyame-logic' npm package version 35.7.5 includes malicious runtime code that dynamically constructs mirror hostnames and DNS fallback domains to download a native binary payload. This payload is assembled from base64-chunked DNS TXT records if needed, saved under disguised filenames in temporary directories, given executable permissions, and executed in a detached manner using OS-specific shell commands. A parallel dropper in telemetry.js uses similar obfuscation and execution techniques. The binary originates from anonymous Cloudflare Workers hosts without pinning, hash verification, or signature, indicating a supply chain compromise or malicious package insertion.

The malicious code enables execution of an unauthorized native binary on the host system, potentially allowing arbitrary code execution. This undermines the trustworthiness of the package and can lead to compromise of systems that install or run this version of the package. The obfuscation and use of multiple fallback domains complicate detection and mitigation.

No official patch or remediation guidance is currently available. Users should immediately avoid using version 35.7.5 of 'checkout-dolyame-logic' and remove it from their environments. Monitor for updates from the package maintainer or npm advisories for any official fixes or removal of the malicious code.