The dolyame-ui-checkable npm package version 35.4.1 includes a malicious dropper that triggers on any require or import of the package. The dropper reconstructs URLs for Cloudflare workers.dev mirrors to download platform-specific binaries over HTTPS, saving them to temporary directories with disguised filenames and executing them detached from the main process. If HTTPS delivery fails, it falls back to a DNS TXT record-based covert channel to retrieve and execute a base64-encoded binary, bypassing typical network egress filtering. Additionally, a second dropper is embedded in telemetry.js, mimicking a Sentry SDK but performing similar malicious binary download and execution. The combination of obfuscation, covert DNS tunneling, and automatic execution characterizes this package as a hostile installer.

Any project importing or requiring dolyame-ui-checkable version 35.4.1 risks automatic execution of malicious binaries that can run arbitrary code on the host system. The use of covert DNS tunneling and disguised filenames increases the likelihood of evading detection and network filtering, potentially leading to system compromise or persistence.

Patch status is not yet confirmed — check the vendor advisory or npm repository for current remediation guidance. Until a fix or official advisory is available, avoid using or importing dolyame-ui-checkable version 35.4.1. Consider removing the package from existing projects and scanning for its presence in dependencies.