The dolyame-ui-dropdown npm package version 35.6.2 includes malicious code that loads a helper script which selects platform-specific endpoints from obfuscated hostnames and DNS TXT record fallbacks to assemble a base64 payload. This payload is downloaded as a binary executable (ELF, Mach-O, or EXE) and saved to temporary directories under deceptive filenames. The binary is made executable and spawned detached via shell commands. The package employs multiple obfuscation methods such as string splitting, array joins, and reflective property access to evade detection. A second dropper stage with similar behavior is present in lib/telemetry.js. This malicious activity occurs at import time, which is unusual and suspicious for a UI dropdown component.

The malicious code can lead to arbitrary code execution on the host system where the package is installed, potentially allowing attackers to run arbitrary binaries with the privileges of the user running the Node.js process. This can result in system compromise, data theft, or further malware deployment. Since the package downloads and executes external binaries, it poses a significant supply chain risk.

No official patch or remediation is currently documented. Users should immediately remove and avoid using dolyame-ui-dropdown version 35.6.2. Audit existing environments for presence of this package and any spawned binaries in temporary directories. Consider blocking network access to the identified malicious domains and DNS TXT record sources. Monitor for suspicious child processes spawned by Node.js applications. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.