The dolyame-ui-memoizeweak npm package (version 35.8.1) includes malicious functionality embedded in its index.js and lib/telemetry.js files. Upon requiring the package, it downloads a platform-specific executable from multiple hardcoded Cloudflare Workers URLs, with a DNS-TXT covert-channel fallback. The downloaded binary is saved to temporary storage with misleading filenames, permissions are set to executable (0755), and it is spawned detached via a shell command. The package uses string fragment concatenation at runtime to reconstruct sensitive API names (e.g., child_process, chmodSync) to evade static analysis. A secondary dropper in telemetry.js base64-decodes fetched data, writes an executable file, and spawns it under the guise of an 'Analytics SDK'. There is no legitimate purpose for this behavior given the package's name and no integrity checks are performed on the downloaded payload.

This malicious package can execute arbitrary code on the host system by downloading and running executables without user consent or verification. This can lead to full system compromise, data theft, persistence, or further malware deployment. The use of covert channels and obfuscation techniques increases the difficulty of detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-memoizeweak from their environments. Avoid installing or using this package until a trusted, verified version is released. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unexpected network connections to the listed Cloudflare Workers endpoints or the fallback DNS domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.