The dolyame-ui-checkbox npm package version 35.6.9 includes malicious code that, when loaded, reconstructs C2 server hostnames from fragmented strings and DNS TXT records to evade analysis. It selects platform-specific endpoints to download attacker-controlled binaries via HTTPS or DNS TXT covert channels if HTTPS is blocked. The binaries are saved to temporary directories with misleading filenames, permissioned as executable, and spawned detached using shell commands. A second dropper module, lib/telemetry.js, mimics an analytics SDK and performs equivalent download and execution steps with base64-decoded payload paths. These anti-analysis features and multi-stage droppers enable stealthy malware deployment through this package.

This malicious package enables remote attackers to execute arbitrary code on systems that install and require dolyame-ui-checkbox version 35.6.9. The attacker-controlled binaries can run with the privileges of the user executing the package, potentially leading to full system compromise, data theft, or further malware deployment. The use of covert DNS TXT record channels and obfuscated host reconstruction complicates detection and analysis.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid using dolyame-ui-checkbox version 35.6.9. Audit and verify all dependencies in software supply chains to exclude this package. Employ package integrity verification and source reputation checks before installation. Monitor for suspicious processes spawned from npm packages and restrict execution permissions in temporary directories where possible. Check vendor advisories or trusted security sources for updates on remediation.