The dolyame-ui-block npm package version 35.1.8 includes a malicious module (_adapter.js) that, when the package is imported, dynamically constructs Cloudflare Workers hostnames to fetch an opaque binary payload. It uses a DNS-TXT fallback mechanism to retrieve base64-encoded payload fragments from a secondary domain. The payload is saved to a hidden file in the system's temporary directory, made executable, and executed via a detached shell or command prompt process without any hash or signature verification. The hostnames are assembled in a way to evade static detection, and re-execution is controlled by a timestamp file. This behavior is a remote code execution dropper disguised within a UI component package.

This malicious code enables remote code execution on the host system during package import or installation, potentially allowing attackers to run arbitrary code with the privileges of the user executing the package. The lack of payload verification and obfuscation increases the risk of undetected compromise. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available. Users should immediately avoid using version 35.1.8 of dolyame-ui-block and remove it from their environments. Verify the integrity and provenance of npm packages before installation. Monitor for suspicious activity related to execution of unknown binaries from temporary directories. Check vendor advisories or npm security notices for updates or official fixes.