The dolyame-ui-mixins npm package (version 35.1.4) includes malicious functionality in its index.js and lib/telemetry.js files. Upon requiring the package, it dynamically constructs URLs to Cloudflare workers.dev hosts to download platform-specific native binaries over HTTPS. If this fails, it uses a DNS TXT record covert channel to retrieve base64-encoded binary chunks from multiple suspicious domains. The binaries are saved under disguised filenames in temporary directories, permissions are set to executable (chmod 0755), and they are spawned detached via shell commands without any integrity checks or signatures. This behavior is inconsistent with the package's declared purpose of providing UI mixins, indicating malicious intent and a supply chain attack.

The malicious code enables execution of arbitrary native binaries on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence. The lack of integrity verification and the use of covert channels complicate detection and mitigation. Since the package is distributed via npm, any project depending on this version may be compromised.

No official patch or remediation is currently documented. Users should immediately avoid using dolyame-ui-mixins version 35.1.4 and remove it from their projects. Monitor for updates or advisories from the package maintainers or npm registry. Employ supply chain security best practices such as verifying package provenance and using trusted dependencies. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.