The dolyame-ui-group npm package version 35.9.7 includes a malicious _loader.js script that, upon require(), dynamically reconstructs obfuscated hostnames to download executables from anonymous worker.dev domains and fallback DNS-TXT channels. These executables are saved to temporary files with cover-story names, permissioned as executable, and spawned detached via shell commands. Additionally, a co-shipped telemetry.js module mimics an analytics SDK but performs the same base64 decode, write, chmod, and spawn sequence. The package uses string concatenation to hide sensitive Node.js APIs such as child_process, fs.chmodSync, and os.hostname to evade static detection. This results in arbitrary code execution on the installer's host at library load time.

Arbitrary code execution on the host system occurs when the malicious package is loaded, allowing execution of untrusted binaries fetched from anonymous and obfuscated sources. This can lead to full system compromise, data theft, or further malware deployment. The malicious behavior activates immediately upon requiring the package, making any dependent project or environment vulnerable.

No official patch or remediation is currently documented for this malicious package version. Users should immediately avoid installing or using dolyame-ui-group version 35.9.7. Remove any installations of this package from projects and dependency trees. Employ package integrity verification and source reputation checks to prevent installing malicious npm packages. Monitor for and block network connections to the identified suspicious domains. Patch status is not yet confirmed — check vendor or repository advisories for updates.