The dolyame-ui-menu npm package version 35.6.1 includes malicious functionality hidden within its index.js file. Upon requiring the package, it loads a _polyfill.js script that fetches a native binary from multiple attacker-controlled Cloudflare Workers domains and fallback subdomains using a DNS-TXT chunked-base64 channel. The fetched binary is saved to temporary directories under misleading filenames, permissioned to be executable, and launched detached from the main process using shell commands (Linux) or cmd.exe (Windows). The execution is gated by environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a filesystem TTL marker to avoid re-execution in analysis environments. This behavior is unrelated to the package's advertised UI component functionality, indicating a supply chain compromise or malicious package.

Users who install and require version 35.6.1 of dolyame-ui-menu risk executing attacker-controlled native code on their systems. This can lead to arbitrary code execution with the privileges of the user running the Node.js process. The malicious code attempts to evade detection by gating execution based on environment variables and filesystem markers, increasing the risk of stealthy persistence or further compromise. There is no indication of active exploitation in the wild yet.

No official patch or remediation guidance is currently provided. Users should immediately avoid using version 35.6.1 of dolyame-ui-menu. Remove the package from all projects and replace it with a trusted alternative. Monitor for any unexpected execution of binaries from temporary directories and consider scanning affected systems for compromise. Since no patch is confirmed, check vendor or repository advisories for updates. Exercise caution when installing npm packages and verify package integrity and provenance.