The dolyame-ui-eventoutside npm package (version 35.8.1) includes malicious code that, upon being required, dynamically constructs URLs to attacker-controlled Cloudflare Workers and fallback domains to download a binary payload. This payload is saved to a disguised temporary file path (e.g., dotnet_diag_<hex>.exe on Windows or .cache_<hex> on Unix), given executable permissions, and executed detached from the main process. The use of string-split obfuscation and masquerading filenames aims to evade static detection. This results in arbitrary code execution on any system that installs or imports this package, which is unrelated to its stated purpose of providing API client wrappers.

Any system that installs or imports dolyame-ui-eventoutside version 35.8.1 is at risk of arbitrary code execution by an attacker, potentially leading to full system compromise. The malicious payload is fetched and executed without user knowledge or consent, bypassing normal security expectations for this package.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing dolyame-ui-eventoutside version 35.8.1. Remove the package from any affected environments and replace it with a trusted alternative. Monitor for and block network connections to the identified malicious domains if possible. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.