The dolyame-ui-constants npm package version 35.5.9 includes malicious code that, when required, loads a support script assembling Cloudflare Workers hostnames and falls back to a suspicious DNS domain. It downloads platform-specific unsigned binaries to temporary directories with misleading names mimicking legitimate tools, sets executable permissions, and spawns them detached via shell commands. Environment variables suggest telemetry but are a cover for dropper behavior. Additionally, a second dropper implementation is embedded in telemetry.js, using base64-decoded buffers and dynamic child process spawning. This results in execution of attacker-controlled code on the host system during installation or require.

Installing or requiring this package leads to arbitrary code execution on the host system, allowing attackers to run unsigned and unverified binaries with the privileges of the user installing the package. This can compromise system integrity and confidentiality. The malicious payload disguises itself as telemetry but is actually a dropper mechanism, increasing the risk of stealthy persistence or further payload delivery.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or requiring dolyame-ui-constants version 35.5.9. Remove any existing installations of this package and audit systems for signs of compromise. Use trusted sources and verify package integrity before installation. Monitor for updates from the package maintainer or npm security advisories for any remediation.