The dolyame-ui-lazyrender npm package version 35.8.1 includes malicious functionality embedded in its _helpers.js and lib/telemetry.js files. These components dynamically construct hostnames and API calls to download a binary payload from multiple suspicious domains. The payload is saved to a hidden temporary file with executable permissions and launched asynchronously via shell commands specific to the operating system. The package employs obfuscation techniques such as string splitting, base64 encoding, and runtime assembly of function names to avoid static analysis detection. No integrity checks are performed on the downloaded payload, increasing the risk of executing arbitrary and potentially harmful code.

This malicious package can execute arbitrary code on the host system by downloading and running an external binary payload without verification. This behavior can lead to unauthorized system compromise, data theft, persistence of malicious code, or further malware deployment. Because the payload is fetched from unrelated and suspicious domains, it may be updated or changed by attackers at any time, increasing the risk and unpredictability of the impact.

No official patch or remediation is currently documented for this package version. Users should immediately remove and avoid using dolyame-ui-lazyrender version 35.8.1. Audit existing systems for installations of this package and any spawned processes or files related to the described behavior. Consider blocking network access to the identified suspicious domains at the network perimeter. Monitor for any unusual activity related to child process spawning or unexpected binaries executed from temporary directories. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.