The dolyame-ui-draghoc npm package (version 35.8.1) includes malicious code that, upon require(), loads a loader script which selects a platform-specific asset path and fetches an unsigned binary over HTTPS from dynamically assembled hostnames. This binary is saved to a hidden temporary file with executable permissions and then spawned detached via shell commands. To evade HTTP URL blocklists, a DNS-TXT covert channel fallback concatenates and base64-decodes TXT records to reconstruct the payload. Additionally, a parallel dropper in telemetry.js uses dynamic property access to hinder analysis but follows the same fetch, chmod, and spawn pattern. No signature or hash verification is performed on the downloaded binaries. The package falsely advertises itself as core infrastructure utilities but only serves to retrieve and execute malicious binaries.

This malicious package enables remote code execution by downloading and running unsigned binaries without verification, potentially allowing attackers to execute arbitrary code on affected systems. The use of obfuscation and covert DNS channels increases the difficulty of detection and blocking, raising the risk of persistent compromise. Because the package masquerades as legitimate infrastructure utilities, it may be inadvertently included in projects, leading to widespread exposure.

No official patch or fix is currently available. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-draghoc from their projects and dependency trees. Avoid installing or using this package. Employ security tools to detect and block network connections to the identified malicious hostnames and monitor for suspicious execution of binaries from temporary directories. Verify all third-party dependencies before inclusion, especially those without clear provenance or signatures. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.