The dolyame-ui-checkablegroup npm package (version 35.8.1) contains embedded malicious code that triggers immediately upon requiring the package. The malicious code assembles obfuscated domain names at runtime to download an opaque binary via HTTPS. This binary is saved to temporary directories with names mimicking legitimate Microsoft diagnostic tools and executed detached from the main process on both Unix and Windows platforms. Additionally, a covert DNS-TXT channel is used to reconstruct a base64-encoded payload from specially crafted subdomains. The dropper code is duplicated in multiple files to ensure execution regardless of import path. No hash or signature verification is performed on the downloaded payload, increasing risk. These techniques indicate deliberate malware distribution under the guise of a UI helper library.

Systems that install and require the dolyame-ui-checkablegroup package version 35.8.1 risk silent execution of malicious binaries downloaded from attacker-controlled infrastructure. This can lead to unauthorized code execution, potential system compromise, and persistence via covert communication channels. The lack of payload verification and obfuscation techniques complicate detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid using dolyame-ui-checkablegroup version 35.8.1. Verify dependencies and source packages carefully before installation. Employ supply chain security measures such as package integrity verification and use trusted package registries. Monitor for any suspicious processes spawned from temporary directories mimicking diagnostic tools. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.