The dolyame-ui-inputcolor npm package version 35.8.1 includes a malicious dropper that triggers on every require() call. It evades static detection by dynamically assembling hostnames from string fragments and selects an OS-specific endpoint to download a binary payload over HTTPS from multiple attacker-controlled hosts. If HTTPS retrieval fails, it uses a DNS-TXT record covert channel to reconstruct the payload. The binary is written to a disguised file in the system's temporary directory, permissions are set to executable, and it is spawned detached using shell commands. This grants the attacker arbitrary code execution on any system that installs or imports this package.

Any system that installs or imports dolyame-ui-inputcolor version 35.8.1 is at risk of arbitrary code execution by an attacker controlling the payload delivery infrastructure. This can lead to full compromise of the affected host.

No official patch or remediation is currently documented. Users should immediately stop using dolyame-ui-inputcolor version 35.8.1 and remove it from their environments. Monitor for any unexpected processes or files in temporary directories indicative of this payload. Check the vendor or npm advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.