The dolyame-ui-inputbox npm package version 35.8.1 includes two JavaScript modules (loader.js and lib/telemetry.js) that act as remote-binary droppers. They dynamically construct hostnames such as oob-worker.cf101-adf.workers.dev and dl.wel1.ru using split string fragments to evade detection. The loader fetches platform-specific binaries, writes them to temporary directories under disguised names (e.g., .cache_<hex>, dotnet_diag_<hex>.exe), sets executable permissions (chmod 0755), and spawns them detached via shell commands. lib/telemetry.js similarly base64-decodes binary chunks, writes, chmods, and executes them detached. This behavior is inconsistent with the package's stated purpose of build and deployment tools, indicating malicious functionality designed to execute unauthorized code on the host system.

This malicious package can execute arbitrary platform-specific binaries on the host system, potentially leading to unauthorized code execution, system compromise, data theft, or persistence of malicious payloads. The obfuscation and dynamic execution techniques make detection and analysis more difficult, increasing the risk of undetected compromise in environments that install this package.

No official patch or remediation is currently documented for this package version. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-inputbox from their environments and avoid installing or updating to this version. Employ package integrity verification and source validation to prevent installation of malicious packages. Monitor for any unexpected execution of binaries from temporary directories and investigate accordingly. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.