The npm package dolyame-ui-label version 35.7.8 contains malicious code that, when loaded, dynamically reconstructs C2 server hostnames from split strings to avoid static analysis. It chooses among several obfuscated endpoints and uses DNS-TXT base64 fallback domains to download a native binary payload via HTTPS. The binary is written to temporary directories (/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows), permissions are set to executable (0755), and it is spawned detached using shell commands. The package falsely claims to be a UI label library and includes misleading comments framing network traffic as analytics or telemetry. The domains contacted are unrelated to any known or documented publisher, indicating malicious intent. There is no evidence of official fixes or patches for this malicious package version.

This malicious package can lead to unauthorized code execution on affected systems by downloading and running a native binary payload. This can result in system compromise, persistence, and potentially further malicious activity. The obfuscation techniques used hinder detection by static analysis tools. Since the package masquerades as a legitimate UI component library, it may be inadvertently included in projects, increasing the risk of compromise.

No official patch or remediation guidance is available for this malicious package version. The recommended mitigation is to avoid using dolyame-ui-label version 35.7.8 entirely. Remove this package from any projects and replace it with a verified, legitimate alternative. Monitor dependency sources carefully to prevent inclusion of malicious packages. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing the package and any binaries it may have dropped.