The dolyame-ui-chart npm package version 35.7.2 includes malicious functionality where, upon requiring the package, it loads a shim that selects a platform-specific asset path and downloads a binary payload from one of four hardcoded Cloudflare Workers hosts, with DNS-TXT fallback to additional domains. The payload is saved to a temporary location with decoy filenames, permissions are set to executable, and it is spawned detached via shell commands. Hostnames and API calls are obfuscated by joining array fragments to evade static detection. Additionally, a secondary dropper embedded in lib/telemetry.js (~81KB) uses base64 decoding, permission setting, and detached execution under the pretense of an analytics SDK. The payloads are opaque, come from non-publisher anonymous sources, and lack hash or signature verification, posing a significant risk of arbitrary code execution.

This malicious package can execute arbitrary binary payloads on the host system without user consent or verification, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and detached execution make detection and analysis difficult. The lack of integrity checks allows attackers to change payloads at will, increasing the risk of persistent and evolving threats.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.7.2 of dolyame-ui-chart from their environments and avoid installing it. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected processes spawned by this package and investigate any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.