The dolyame-ui-inputphone npm package (version 35.8.1) includes code in its index.js that loads a runtime script which downloads a platform-specific binary from Cloudflare Workers endpoints and fallback domains. The hostnames are dynamically reconstructed at runtime to evade static analysis. The downloaded binary is saved to a temporary file with misleading filenames, permissions are set to executable, and it is executed detached via shell commands on Unix and Windows. No integrity checks such as hash or signature verification are performed. The package's main export, lib/telemetry.js, acts as a facade resembling an analytics SDK but internally performs the same download and execution steps, serving as a cover for the malicious dropper functionality.

This malicious package can execute arbitrary code on the host system with the permissions of the running process, potentially leading to full system compromise, data theft, or further malware deployment. The lack of integrity verification and use of obfuscation techniques increase the risk of undetected exploitation.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.8.1 of dolyame-ui-inputphone from their projects and avoid installing it. It is recommended to audit dependencies for similar malicious packages and use trusted sources. Monitor for updates from the package maintainer or npm advisories for any remediation announcements.