The dolyame-ui-inputtime npm package (version 35.8.1) includes a malicious dropper in its index.js and lib/telemetry.js files. Upon requiring the package, it fetches a platform-specific executable from obfuscated Cloudflare Workers domains, with a DNS TXT record fallback to retrieve payload chunks. These chunks are base64 decoded, concatenated, saved to temporary files with misleading names, permissioned for execution, and launched detached from the parent process to evade detection. The package uses runtime string concatenation to evade static analysis and disguises itself as an observability SDK, though its actual behavior is malicious and unrelated to its manifest metadata.

This malicious package can execute arbitrary code on the host system by downloading and running executables without user consent. This can lead to unauthorized system compromise, persistence, and potentially further malicious activity. The obfuscation and covert channel techniques increase the difficulty of detection and analysis.

No official patch or remediation is currently available. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-inputtime from their environments and avoid installing this package. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for any signs of compromise related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.