The dolyame-ui-form npm package (version 20.1.7) acts as a dropper. Upon requiring the package, it loads a _bootstrap.js script that selects a payload based on OS and architecture. This payload is downloaded from several hardcoded Cloudflare Workers hosts or via DNS TXT-record fallback domains. The downloaded bytes are saved to a randomly named file in temporary directories, disguised as .NET diagnostic or cache files, set executable, and launched detached via shell commands. The package exports only an empty stub and declares no dependencies, using the UI form claim as a cover story. The runtime reconstructs destination hostnames from substrings to evade static detection. This behavior indicates full system compromise upon installation.

Any system with this package installed is likely fully compromised, as the package downloads and executes arbitrary code from attacker-controlled servers. This can lead to complete loss of confidentiality, integrity, and availability. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment. Removing the package alone may not remove all malicious components or backdoors installed by the payload.

Remove the dolyame-ui-form package version 20.1.7 immediately. Consider the affected system fully compromised and perform a thorough incident response, including secret and key rotation from a separate trusted system. There is no official patch or fix available. Monitor for any suspicious activity related to this package and avoid installing packages from untrusted sources.