The dolyame-ui-clickoutsidehoc npm package (version 35.8.1) contains obfuscated malicious code that, when imported, dynamically constructs hostnames to fetch a platform-specific binary from Cloudflare Workers-hosted URLs and DNS TXT record fallbacks. It writes this binary to the system's temporary directory under disguised filenames, sets executable permissions, and executes it detached via shell commands. The package name mimics a legitimate UI higher-order component utility but instead functions as a dropper for attacker-controlled native code, enabling remote code execution on any host that installs or imports this package.

Hosts that install or import the affected version of this package will execute attacker-controlled native code with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, persistence, or further malicious activity. The package does not provide any legitimate functionality, indicating it is solely designed for malicious purposes.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing or importing the dolyame-ui-clickoutsidehoc package, specifically version 35.8.1. Conduct a thorough investigation for any signs of compromise if this package was used. Use trusted sources and verify package authenticity before installation. Monitor for updates from the package repository or security advisories for any official remediation.