The dolyame-ui-inputfio npm package version 35.8.1 includes malicious code in _adapter.js and lib/telemetry.js that reconstructs destination hostnames from obfuscated string fragments and fetches an opaque binary payload over HTTPS with a DNS TXT fallback. The payload is written to temporary files on Unix or Windows systems, permissions are set to executable, and the payload is executed detached via shell commands. The code uses string splitting and array joining to evade static string matching detection. This malicious behavior triggers unconditionally when the package is imported, masquerading as an analytics SDK.

Importing the affected package version results in automatic execution of a dropped binary payload with system-level privileges, potentially allowing arbitrary code execution on the host system. This can lead to full system compromise depending on the payload's capabilities. The malicious code operates without user interaction and uses evasion techniques to avoid detection.

No official patch or remediation is currently documented for this package version. Users should avoid using dolyame-ui-inputfio version 35.8.1 and remove it from their projects. Verify dependencies and replace with trusted alternatives. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.