The dolyame-ui-collapseblock npm package version 35.8.1 includes a malicious loader (_shim.js) that, when required, dynamically reconstructs Cloudflare Workers hostnames to fetch an OS/architecture-specific native binary. This binary is saved under disguised names in temporary directories, permissioned for execution, and spawned detached via shell commands. If HTTPS retrieval fails, the loader uses a DNS-TXT record covert channel to reconstruct the binary from base64-encoded chunks across sequentially numbered subdomains. The package automatically executes this attacker-controlled binary without any version pinning or cryptographic verification, enabling arbitrary code execution. The presence of a 21028-second cache stamp and undocumented environment variables for operator opt-out align with known hostile dropper techniques rather than legitimate package functionality.

This malicious package enables remote code execution on any system that imports dolyame-ui-collapseblock version 35.8.1, allowing attackers to run arbitrary native binaries with the privileges of the importing process. The lack of integrity checks or version pinning means the payload can be changed or updated by the attacker at will. This compromises system security and can lead to further malware deployment or system takeover.

No official patch or remediation is currently documented. Users should immediately stop using dolyame-ui-collapseblock version 35.8.1 and remove it from their environments. Avoid importing this package or any versions related to it until a vendor advisory or patch is released. Monitor for any unauthorized execution of binaries from temporary directories and consider scanning systems for the presence of the described payload files. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.