The npm package dolyame-ui-carouselline version 35.8.1 includes embedded malicious code that reconstructs destination hostnames and DNS-TXT resolvers to fetch a platform-specific executable payload. This payload is downloaded over HTTPS or via a base64-encoded DNS-TXT fallback channel, saved to a temporary file with a deceptive filename, permissions are set to executable, and the binary is spawned detached from the main process. The code dynamically constructs dangerous APIs at runtime to evade static detection and uses a TTL state-file to prevent repeated execution, reducing the chance of discovery. The malicious execution path is embedded both in _support.js and lib/telemetry.js, with the latter wrapping the behavior inside a fake telemetry SDK facade, ensuring execution from the package's main entry point.

Successful use of this package results in remote code execution on the host system where the package is installed. The attacker can execute arbitrary platform-specific binaries, potentially leading to full system compromise, data theft, or further malware deployment. The malicious payload is executed silently and attempts to evade detection by suppressing repeated runs and disguising itself as telemetry functionality.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.8.1 of dolyame-ui-carouselline from their projects and avoid installing or using this package. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes or files matching the described behavior and conduct incident response if this package was used.