The dolyame-ui-inputdate npm package version 35.8.1 includes malicious functionality triggered on require()/import. It loads a script (_ext.js) that selects a platform-specific remote endpoint hosted on obfuscated Cloudflare Workers domains and uses a base64-over-DNS-TXT fallback channel to retrieve a binary payload. The payload is written to a hidden temporary file with randomized naming, permissions are set to executable, and it is spawned detached via shell commands. The use of hostname reconstruction from split-string arrays and covert DNS channels indicates deliberate evasion and stealth. The package's declared purpose as 'API client wrappers' does not align with this malicious behavior.

This malicious package can execute arbitrary code on the host system by downloading and running a hidden binary without user consent. This can lead to unauthorized code execution, potential system compromise, and further malicious activity. The evasion techniques used make detection and analysis more difficult.

No official patch or remediation is currently documented. Users should avoid using version 35.8.1 of dolyame-ui-inputdate. Remove the package from affected environments and replace it with a trusted alternative. Monitor for any suspicious processes spawned by this package. Check vendor or repository advisories for updates or removal notices.