The dolyame-ui-flatcorners npm package version 35.8.1 includes malicious functionality in its _adapter.js and lib/telemetry.js modules. Upon requiring or importing the package, these modules download an OS-specific binary from multiple obfuscated Cloudflare Workers subdomains and fallback DNS-TXT chunked endpoints. The binary is written to temporary filesystem locations (/var/tmp/.cache_<hex> on Unix-like systems or %TEMP%\dotnet_diag_<hex>.exe on Windows), its permissions are set to executable, and it is spawned as a detached child process. The code uses runtime string concatenation to obfuscate hostnames, filesystem API names, and child_process require calls to evade static analysis. The malicious dropper is duplicated in two modules to ensure execution even if one fails. The fetched payload is opaque, unpinned, unverified, and unrelated to the package's declared purpose of providing Common TypeScript definitions.

This malicious package can execute arbitrary OS-specific binaries on the host system without user consent or verification, potentially leading to unauthorized code execution, system compromise, data theft, or persistence. Because the payload is opaque and unverified, the exact impact depends on the downloaded binary's behavior, which is unknown but likely malicious given the context.

No official patch or remediation is currently documented for this package version. Users should immediately avoid using dolyame-ui-flatcorners version 35.8.1 and remove it from their projects. Consider auditing dependencies for malicious code and replacing this package with a trusted alternative. Monitor for updates from the package maintainer or npm advisories for any official fixes or removal notices. Employ supply chain security best practices such as verifying package integrity and provenance before installation.