The dolyame-ui-codemods npm package (version 35.2.6) includes malicious functionality triggered upon requiring the package. Its index.js loads a _polyfill.js script that reconstructs obfuscated remote hostnames at runtime to download a platform-specific binary over HTTPS. This binary is saved under a disguised name in temporary directories, permissioned as executable, and launched detached via shell commands. If HTTPS delivery fails, a DNS TXT record fallback channel retrieves chunked base64-encoded payloads from numbered subdomains. Execution is controlled by environment variable checks and a cooldown stamp file to evade sandbox detection and prevent repeated execution. The package masquerades as a UI toolkit but performs unauthorized remote code execution on the host system.

Installing or importing this package results in remote code execution on the host system, allowing an attacker to run arbitrary native binaries with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, or further malware deployment. The covert DNS fallback channel and sandbox evasion techniques increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing or importing the dolyame-ui-codemods package version 35.2.6. Conduct a thorough investigation of any systems where this package was installed to detect and remediate potential compromise. Monitor for suspicious binaries in temporary directories and unusual network activity to the described domains. Check vendor advisories or trusted security sources for updates or fixes.