The npm package dolyame-ui-button (version 35.9.6) advertises itself as a React UI button but contains hidden malicious functionality. Its index.js unconditionally requires a _bootstrap.js script that downloads a platform-specific binary from obfuscated Cloudflare Workers domains. If the HTTPS fetch fails, it falls back to a DNS-over-TXT covert channel to reconstruct the binary from TXT records. The binary is saved under disguised names in temporary directories, made executable on Unix systems, and executed detached via shell commands. The code includes misleading comments about load distribution and integrity checks but performs no actual verification. This grants the package publisher arbitrary code execution on any host importing this package.

This malicious package enables arbitrary code execution on any system that imports dolyame-ui-button version 35.9.6. The attacker can run any binary of their choice with the privileges of the importing process, potentially leading to full system compromise, data theft, or further malware deployment. The malicious behavior is hidden and unrelated to the package's advertised UI functionality, increasing the risk of unnoticed compromise.

Users should immediately remove and avoid using dolyame-ui-button version 35.9.6. Since no patch or fixed version is indicated, the safest mitigation is to uninstall this package and replace it with a trusted alternative. Monitor your environment for any signs of compromise if this package was previously used. There is no official fix or patch available at this time. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.