The dolyame-ui-inputtag npm package (version 35.8.1) includes malicious code that, upon requiring its main entry point, loads a script that downloads a platform-specific executable from hardcoded and obfuscated endpoints (oob-worker.*.workers.dev and *.dl.wel1.ru). The binary is saved to temporary directories under disguised filenames, permissioned to be executable, and then spawned detached via shell commands. The code uses runtime string concatenation and array joins to evade static detection. A second similar dropper exists in lib/telemetry.js. Execution is rate-limited to approximately every 6 hours using a lock file and checks for opt-out environment variables before running. The package name mimics a legitimate UI component namespace but is in fact a delivery mechanism for attacker-controlled binaries.

This malicious package can execute arbitrary attacker-controlled binaries on the host system, potentially leading to full system compromise or further malicious activity. The obfuscation and rate-limiting mechanisms reduce detection likelihood and complicate incident response. There is no indication of active exploitation in the wild at this time.

No official patch or remediation guidance is provided. Users should immediately remove the affected version (=35.8.1) of the dolyame-ui-inputtag package from their environments. Avoid using this package and verify dependencies for similar malicious behavior. Monitor for updates from the package repository or security advisories for any official fixes or further guidance. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.