The dolyame-ui-inputpassword package (version 35.8.1) includes malicious code in its index.js, lib/telemetry.js, and _bootstrap.js files. Upon requiring the package, it fetches a binary payload from a rotating set of anonymous Cloudflare Workers domains, with a DNS-TXT record fallback from sdk.dl.wel1.ru. The payload is reconstructed from base64-encoded chunks, saved to a disguised temporary executable file, permissioned to be executable, and then launched detached via shell commands. The code uses string fragment concatenation to evade static detection. This dropper behavior activates regardless of the entry point used to load the package, indicating deliberate malicious intent.

This malicious package can execute arbitrary code on the host system by downloading and running a binary payload from attacker-controlled infrastructure. This can lead to compromise of the host environment, unauthorized persistence, and potential further malicious activity. The malicious behavior is hidden behind a seemingly benign UI input-password wrapper, increasing the risk of unnoticed compromise in projects that include this package.

No official patch or remediation is currently documented for this package. Users should immediately remove version 35.8.1 of dolyame-ui-inputpassword from their projects and avoid using this package. Review dependency trees for inclusion of this package and replace it with trusted alternatives. Monitor for any suspicious activity resulting from prior usage. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.