The dolyame-ui-carousel npm package version 35.3.3 includes a malicious shim.js script that dynamically selects a platform-specific payload path and downloads a native binary from obfuscated Cloudflare Workers hosts. It uses string-array joins to evade static detection and implements a DNS TXT chunked-base64 covert-channel fallback to additional domains. The downloaded binary is saved to disguised paths in /tmp or %TEMP%, given executable permissions, and executed detached from the main process. Execution is gated by a stamp file to prevent repeated runs. The package uses misleading identifiers such as _NODES, analytics_state, and DISABLE_TELEMETRY to conceal its drop-and-execute behavior. This activity is inconsistent with the package's stated purpose as a UI carousel component, indicating malicious intent.

The malicious code enables remote code execution on any system importing the affected package version, potentially allowing attackers to execute arbitrary native binaries without user consent. This compromises system integrity and confidentiality. The covert download and execution mechanism bypasses normal package expectations and may evade detection by static analysis tools. No known exploits in the wild are reported at this time.

No official patch or remediation is currently documented. Users should immediately avoid using dolyame-ui-carousel version 35.3.3 and remove it from their environments. Consider replacing it with a trusted alternative or verifying package integrity before use. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals.