The dolyame-ui-breadcrumbs npm package version 35.6.5 includes a malicious module (_bridge.js) that reconstructs C2 hostnames at runtime using string operations. It fetches an opaque binary payload from obfuscated, non-registry domains and writes it to temporary locations on Unix or Windows systems under disguised names. The payload is then made executable and launched detached via shell commands, granting full remote code execution on the host. A freshness marker file is also created to track execution state. This behavior allows an attacker to execute arbitrary code on any system that installs this package version.

Successful installation and execution of this package version results in full remote code execution on the host system. The attacker-controlled payload can run arbitrary commands with the privileges of the user installing the package, potentially leading to system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing dolyame-ui-breadcrumbs version 35.6.5. If already installed, remove the package and scan affected systems for the presence of the dropped payloads and related artifacts. Monitor for suspicious processes and network connections to the indicated C2 domains. Verify package integrity by sourcing from trusted registries and consider using package integrity verification tools.