The dolyame-ui-popup npm package is malicious. When required, its index.js loads a helper script that fetches a platform-specific binary from Cloudflare Workers mirrors and fallback domains controlled by attackers. The binary is saved to hidden temporary directories, permissions are set to executable, and it is launched detached using shell commands. The package uses obfuscation techniques such as string splitting and base64-over-DNS chunk assembly to evade static analysis. No integrity checks like hash or signature verification are performed on the downloaded binaries. The package advertises UI popup components but contains no UI code, only malicious payload delivery mechanisms.

Systems that install and require the dolyame-ui-popup package risk execution of attacker-controlled binaries without verification, leading to potential full compromise of the host environment. The malicious code runs with the privileges of the executing process and can perform arbitrary actions. This undermines supply chain trust and can facilitate further attacks.

Avoid using the dolyame-ui-popup package, especially version =35.8.7. Since no official patch or remediation is indicated, remove the package from your environment if present. Monitor for any unexpected binaries in temporary directories and restrict execution permissions where possible. Verify package integrity before installation and prefer trusted sources. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.