The npm package dolyame-ui-overridestyles at version 35.8.1 includes a malicious setup routine triggered on require() that downloads platform-specific executables from Cloudflare Workers and fallback hosts. These binaries are reconstructed from base64 buffers or downloaded directly, saved to temporary files with executable permissions, and executed detached via shell commands. The package constructs hostnames and critical functions dynamically to evade static analysis. No cryptographic verification of the downloaded payloads is performed. This behavior is inconsistent with the package's stated purpose as a UI style override library, indicating malicious intent.

The malicious package can execute arbitrary code on the host system by downloading and running unverified binaries. This can lead to full system compromise depending on the payload delivered. The lack of integrity checks and obfuscation techniques increase the risk of undetected exploitation. The package's execution of detached processes can evade simple detection and allow persistent malicious activity.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-overridestyles from their projects and avoid installing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes spawned by this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.