The dolyame-ui-form npm package version 20.1.7 includes a malicious dropper mechanism. Upon requiring the package, its index.js loads a _bootstrap.js script inside a try/catch block that silently downloads executable payloads from multiple hardcoded Cloudflare Workers domains and DNS TXT record fallbacks. These payloads are saved under temporary directories with randomized filenames and disguised as .NET diagnostic or cache files, then executed detached via shell commands. The package name mimics a legitimate brand to deceive users, while the actual exported code is an empty stub with no UI functionality, serving as a cover for the malicious activity.

Systems that install and run dolyame-ui-form version 20.1.7 risk silent execution of arbitrary code downloaded from attacker-controlled infrastructure. This can lead to compromise of the host environment, persistence, and further malicious activity. The obfuscation techniques used make detection and static analysis difficult.

No official patch or remediation guidance is currently available. Users should immediately remove the dolyame-ui-form package version 20.1.7 from their environments and avoid installing it. Monitor for any unexpected processes or files matching the described behavior. Use trusted sources and verify package integrity before installation.