The dolyame-ui-container npm package (version 35.3.7) includes malicious code in its index.js that loads a compatibility module (_compat.js). This module downloads a platform-specific binary payload from dynamically constructed external hostnames unrelated to the publisher. If HTTPS download fails, it uses a DNS-over-TXT covert channel to retrieve the payload, which is base64-decoded and saved under disguised filenames in temporary directories. The payload is then executed detached via system shell commands without any hash or signature verification. The package also checks environment variables related to telemetry and tracking to avoid detection, and uses analytics-style filenames as cover. These actions indicate a deliberate attempt to execute unauthorized code on the host system.

This malicious package can lead to arbitrary code execution on systems that install version 35.3.7 of dolyame-ui-container. The downloaded binary is executed with no integrity checks, potentially allowing attackers to run any code remotely. This compromises the security and integrity of affected systems and may lead to further malicious activities such as data theft, persistence, or lateral movement.

No official patch or remediation is currently documented. Users should avoid installing or using version 35.3.7 of dolyame-ui-container. Remove the package if already installed and scan affected systems for unauthorized binaries and processes spawned by this package. Monitor for network connections to the suspicious domains mentioned. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates. Consider using package integrity verification tools and restrict execution of binaries from temporary directories.