The dolyame-ui-editor npm package version 35.6.6 is a malicious package that, upon loading, unconditionally requires a loader script which fetches an opaque binary payload from a rotating set of Cloudflare Workers hosts and DNS TXT-record fallback channels. The payload is saved to temporary directories with disguised filenames, permissions are set to executable, and the binary is executed detached from the main process using platform-specific shell commands. The package uses obfuscation techniques such as dynamic require calls and indirect access to filesystem functions to evade static detection. No integrity checks or signature verifications are performed on the fetched payload, which is unrelated to the package's stated functionality. This behavior results in arbitrary code execution on the host system when the package is installed or required.

This malicious package enables arbitrary code execution on any system that installs or requires dolyame-ui-editor version 35.6.6. The attacker-controlled payload can perform any action permitted by the executing user's privileges, potentially leading to system compromise, data theft, persistence, or further malware deployment. Because the payload is fetched dynamically and without verification, the attacker can change the payload at will, increasing the risk and unpredictability of the impact.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing or using dolyame-ui-editor version 35.6.6. Users should verify package authenticity before installation, prefer packages from trusted sources, and monitor for suspicious behavior related to npm packages. If this package is found in a project, it should be removed immediately and the environment should be inspected for signs of compromise. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for any updates.