The dolyame-ui-inputcount npm package version 35.8.1 includes malicious code in its _helpers.js and lib/telemetry.js files. When the package is imported, it detects the host OS and architecture, then downloads a platform-specific binary from one of several obfuscated Cloudflare Worker endpoints, with DNS TXT record fallback to suspicious domains. The binary is saved to a temporary location with executable permissions and executed in a detached shell process. The code uses string concatenation to hide suspicious calls such as require('child_process') and fs.chmodSync, and includes a marker file to prevent repeated execution. The package name mimics a legitimate UI component library but performs unauthorized remote code execution at import time.

This malicious package enables remote code execution on the host system by downloading and running an unauthorized binary. This can lead to full system compromise, data theft, persistence, and further malicious activity. The obfuscation and use of anonymous Cloudflare Worker infrastructure complicate detection and attribution. There is no indication of active exploitation in the wild yet, but the presence of such code in a widely used package repository poses a significant risk to developers and production environments that depend on this package.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.1 of dolyame-ui-inputcount from their dependencies and avoid installing or importing this package. Audit existing environments for the presence of the package and any dropped binaries in temporary directories. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages. Monitor vendor advisories and trusted security sources for updates or official fixes.