The npm package dolyame-ui-contextmenusearchable version 35.8.1 includes malicious code that reconstructs hostnames at runtime to download a platform-specific binary from anonymous Cloudflare Workers domains. This binary is saved to temporary locations on Unix or Windows systems, masquerading as a .NET diagnostic file, then given executable permissions and spawned in a detached process with ignored stdio. The package uses obfuscation techniques such as string concatenation to evade static analysis, including reassembling dangerous API names like 'child_process' and 'chmodSync'. There are two import-time execution paths that perform this dropper behavior. The package misrepresents itself as a data transformation/analytics utility, but the downloaded binary's function is unknown and the delivery infrastructure is unrelated to any legitimate publisher.

This malicious package can execute arbitrary code on the host system by downloading and running an opaque binary, potentially leading to full system compromise or unauthorized actions. The obfuscation and dual execution paths increase the difficulty of detection. Since the binary is fetched from anonymous and mutable Cloudflare Workers domains, the payload can be changed dynamically, increasing risk. No known exploits in the wild are reported yet, but the presence of this package in a project can lead to serious security breaches.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.1 of dolyame-ui-contextmenusearchable from their projects and avoid using this package. Audit dependencies for this package and any related versions. Monitor for vendor advisories or updates regarding this package for any official fixes or further guidance. Since this is a malicious package, replacing it with a trusted alternative or removing it entirely is recommended.