The [email protected] package includes a _shim.js file loaded at module import that detects the host OS and architecture, then downloads a native binary from obfuscated Cloudflare Workers hosts or DNS TXT record fallbacks. The binary is saved to temporary directories under decoy names, permissions are set, and it is executed detached from the main process. Additional telemetry code in lib/telemetry.js implements similar dropper functionality. The obfuscation and mismatch with the package's declared UI functionality indicate a supply-chain attack vector that executes attacker-controlled code on installation or import.

Installing or importing [email protected] results in execution of an attacker-controlled native binary on the host system. This can lead to arbitrary code execution, potentially compromising system integrity, confidentiality, and availability depending on the payload of the dropped binary.

No official patch or remediation is currently documented. Users should avoid installing or importing dolyame-ui-confirmation version 35.3.3. Verify package integrity and source before use. Monitor for updates or advisories from the package maintainer or npm registry regarding this issue. Consider removing the package from projects and replacing it with trusted alternatives.