The 'dolyame-ui-datatable' npm package (version 35.8.1) contains malicious code that downloads and executes platform-specific binaries from anonymous Cloudflare Workers subdomains and a DNS-TXT fallback domain. It writes these binaries to temporary directories with innocuous filenames, sets executable permissions, and spawns them detached via shell commands. The package dynamically reconstructs hostnames and module names to evade static detection. It includes redundant dropper code paths reachable via the package main entry. No signature or hash verification is performed on the downloaded payloads. The package does not contain legitimate UI or datatable code, indicating it is a typosquatting or dependency confusion carrier.

This malicious package enables arbitrary code execution on the host system by downloading and running unverified binaries. This can lead to full system compromise, data theft, or further malware deployment. The obfuscation and lack of verification increase the risk of undetected infection. Since the package masquerades as a legitimate utility, it may be inadvertently installed by developers, spreading the compromise.

Avoid using the 'dolyame-ui-datatable' package version 35.8.1. Remove it from all projects and dependency trees. Use verified and trusted packages from official sources. Monitor for any unexpected downloads or execution of binaries from temporary directories. Since no official patch or fix is available, remediation involves removing the malicious package and replacing it with legitimate alternatives. Review dependency sources to prevent typosquatting or dependency confusion attacks.