The dolyame-ui-focusstatehoc npm package version 35.8.1 includes malicious bootstrap routines in _compat.js and lib/telemetry.js that download platform-specific binaries from a shuffled list of obfuscated Cloudflare Workers subdomains, with DNS-TXT fallbacks to suspicious Russian domains. These binaries are saved under disguised names in temporary directories, permissions are set to executable, and they are spawned detached via shell commands. The package employs runtime string concatenation to reconstruct sensitive hostnames and API names to evade static detection. Additionally, lib/telemetry.js assembles and executes a base64-encoded payload at load time, enabling a second remote code execution path. There is no version pinning or integrity verification of the downloaded binaries. The malicious behavior is disguised under an analytics/telemetry cover story with opt-out environment variables.

This malicious package enables remote code execution on any system that installs and requires dolyame-ui-focusstatehoc version 35.8.1. The attacker can execute arbitrary platform-specific binaries with the privileges of the running process, potentially leading to full system compromise. The obfuscation and multiple execution paths increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove and avoid using dolyame-ui-focusstatehoc version 35.8.1. Since no integrity verification is performed, do not trust this package or its binaries. Monitor for and block network connections to the listed suspicious Cloudflare Workers subdomains and fallback domains. Consider scanning existing environments for presence of the disguised binaries in temporary directories and remove them. Check vendor advisories or npm security advisories for updates or official guidance.