The dolyame-ui-iconspack npm package (version 35.8.1) masquerades as an icon pack but contains embedded malicious code. Its index.js unconditionally loads a shim that reconstructs Cloudflare Workers hostnames from fragmented strings and uses DNS-TXT records from unrelated domains to retrieve a base64-encoded payload. This payload is a platform-specific binary which the package writes to temporary storage, sets executable permissions, and spawns detached processes to run it. The main package file also contains a parallel dropper using similar obfuscation and execution methods. There is no hash or signature verification of the downloaded payload, increasing risk. The external hosts and behavior are unrelated to the package's declared purpose, indicating malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running an unverified binary, potentially leading to system compromise. The obfuscation and use of external, unrelated domains for payload delivery increase the difficulty of detection and analysis. The execution of detached processes without user consent or verification poses a significant security risk.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.8.1 of dolyame-ui-iconspack. Audit systems for presence of this package and any spawned binaries in temporary directories. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for suspicious network activity related to the described external domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.