The dolyame-ui-inputtools npm package (version 35.8.1) includes malicious functionality that, upon require(), loads a script which constructs URLs to download executables from multiple rotating Cloudflare Workers hosts and other domains. It uses a DNS TXT record covert channel to reassemble base64-encoded payloads as a fallback. The downloaded payloads are saved to temporary directories with disguised filenames, made executable, and then executed in detached shell processes without any hash or signature verification. This behavior is duplicated in the package's main export, lib/telemetry.js, which obfuscates child_process and fs.chmodSync calls. The package's stated purpose as an 'Analytics SDK / observability' module is a cover for this malicious behavior.

This malicious package can lead to arbitrary code execution on the host system where it is installed, potentially allowing attackers to run unauthorized binaries. The lack of integrity checks and the use of covert channels for payload delivery increase the risk of undetected compromise. This can result in system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this package. Users should immediately remove version 35.8.1 of dolyame-ui-inputtools from their environments. Avoid installing or using this package from untrusted sources. Monitor for any unexpected processes spawned from temporary directories and verify the integrity of dependencies before use.