The dolyame-ui-portal npm package version 35.3.6 includes embedded malicious code that, when the package is installed or required, unconditionally loads a module that constructs obfuscated URLs to download platform-specific binaries from attacker-controlled Cloudflare Workers domains and a DNS-TXT discovery domain. These binaries are saved to temporary directories under misleading filenames, given executable permissions, and executed in a detached manner using shell commands. The dropper checks for opt-out environment variables to evade sandbox or telemetry analysis. Additionally, a parallel dropper is embedded in a telemetry-related module but is not currently triggered. This behavior results in execution of attacker-controlled code outside the npm package publisher's infrastructure.

This malicious package enables remote code execution on the host system where it is installed or required, allowing attackers to run arbitrary binaries downloaded from external infrastructure. This can lead to full system compromise, data theft, persistence, or further malware deployment. The code evades sandbox detection and telemetry opt-outs, increasing the risk of undetected compromise.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing or requiring dolyame-ui-portal version 35.3.6. Remove any installations of this package from environments and audit systems for signs of compromise. Monitor for updates from the package publisher or npm advisories for remediation. Since this is a malicious package, the best mitigation is to not use it and remove it if present.