The npm package dolyame-ui-inputsecure version 35.8.1 includes malicious code embedded in its main entry files (_shim.js and lib/telemetry.js). These scripts fetch a platform-specific executable from obfuscated Cloudflare workers.dev endpoints with DNS-TXT fallbacks to suspicious Russian domains. The fetched payload is base64-decoded, written to a temporary file, permissions set to executable, and then executed detached from the parent process. The code uses dynamic string assembly and property access to evade static detection. This dropper logic is duplicated in two modules to ensure execution regardless of which is loaded. The malicious payload runs under the guise of an 'Analytics SDK' to mislead inspection. Installing or requiring this package results in execution of attacker-controlled native code on the host system.

Successful installation or requiring of the affected package leads to execution of attacker-controlled native code on the host system. This allows the attacker to run arbitrary commands with the privileges of the user installing the package, potentially leading to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 35.8.1 of dolyame-ui-inputsecure. Remove any installations of this package from systems. Monitor for suspicious activity related to this package. Since no patch is available, the best mitigation is to avoid use and remove the malicious package. Check vendor or repository advisories for updates or official guidance.