The dolyame-ui-draggable npm package version 35.4.6 masquerades as a UI toolkit but contains malicious code that, upon requiring its main entry, downloads a platform-specific binary from Cloudflare Workers hosts controlled by the author. The binary is written to system temporary directories with names like .cache_<random> or dotnet_diag_<random>.exe, permissions are set to executable, and it is spawned detached via a shell command. Host and domain strings are dynamically constructed to evade static detection, and a DNS-TXT base64 fallback channel is implemented. The execution is gated by environment variables that disable telemetry and is rate-limited using a timestamp file. This download-and-execute behavior is unrelated to the package's stated purpose and represents a supply chain malicious code threat.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise. The obfuscation and fallback communication channels increase the difficulty of detection and analysis. Since the binary runs detached and uses common temporary file paths, it may evade casual inspection. The impact is significant as it compromises the integrity of the software supply chain and can lead to system compromise or data exfiltration depending on the payload.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove version 35.4.6 of dolyame-ui-draggable from their environments and avoid installing it. It is recommended to audit dependencies for this package and replace it with a trusted alternative. Monitor for any processes or files matching the described behavior and clean affected systems. Since this is a malicious package, the vendor does not provide a fix; mitigation relies on removal and prevention of installation.