The dolyame-ui-inlineedit npm package (version 35.8.1) masquerades as a UI utility but contains an install-time dropper triggered on require(). It dynamically constructs hostnames to evade static detection and downloads a platform-specific binary from Cloudflare Workers subdomains and fallback domains. The binary is saved to hidden paths (/var/tmp or disguised .exe on Windows), permissions are set to executable, and it is spawned detached via shell commands. The package's telemetry module exports this malicious behavior, embedding base64-encoded payloads and misleading comments referencing integrity checks and telemetry opt-outs to disguise its true intent.

Any project or environment that installs and requires dolyame-ui-inlineedit version 35.8.1 risks silent execution of arbitrary, unsigned binaries downloaded from attacker-controlled infrastructure. This can lead to unauthorized code execution, persistence, and potential compromise of the host system. The lack of signature verification and obfuscation techniques increase the risk of undetected malicious activity.

No official patch or remediation is currently documented. Users should immediately cease using dolyame-ui-inlineedit version 35.8.1 and remove it from their projects. Verify dependencies for malicious packages and replace with trusted alternatives. Monitor for any unusual activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.