The dolyame-ui-pageheader npm package (version 35.8.1) masquerades as a common TypeScript definitions package but includes malicious code that unconditionally requires a module (_bridge.js) which fetches a platform-specific binary payload from one of several Cloudflare workers.dev hosts. The payload is downloaded over HTTPS with a DNS-TXT base64 fallback, saved to a temporary directory under disguised names, permissioned as executable, and executed detached via shell commands. The package uses string concatenation to obfuscate endpoint hostnames and the child_process API to evade static detection. An additional redundant execution channel exists in lib/telemetry.js with similar fetch and execution behavior. Installing or requiring this package grants the remote operator full host remote code execution capabilities.

Successful installation or requiring of this package results in full remote code execution on the affected host system. The attacker can execute arbitrary code with the privileges of the user running the Node.js process, potentially leading to complete system compromise.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 35.8.1 of dolyame-ui-pageheader. Remove the package from any affected environments and audit systems for signs of compromise. Monitor for updates or advisories from the package maintainers or npm registry. Due to the lack of a vendor advisory or patch, patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.