The dolyame-ui-link npm package (version 35.8.5) includes malicious code embedded in index.js and lib/telemetry.js. Upon requiring the package, it reconstructs attacker-controlled hostnames for Cloudflare Workers and DNS-TXT fallback channels, then downloads platform-specific binaries over HTTPS. These binaries are saved to temporary locations with disguised names, permissions are set to executable, and the binaries are launched detached via shell commands. This results in arbitrary native code execution on the installer's host system immediately upon package use.

This malicious package enables attackers to execute arbitrary native code on the host system of anyone who installs or requires the affected version. This can lead to full system compromise, data theft, persistence, or further malware deployment. The execution happens automatically on require, requiring no additional user action beyond installing or importing the package.

No official patch or remediation is currently documented. Users should immediately avoid installing or using dolyame-ui-link version 35.8.5. Remove the package from any affected systems and replace it with a trusted alternative. Monitor for any signs of compromise if this package was previously installed. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.