The dolyame-ui-postcssconfig npm package (version 35.8.1) includes malicious code that, upon require(), loads scripts which fetch platform-specific binaries over HTTPS from multiple hardcoded Cloudflare Workers hostnames and fallback DNS TXT-record domains. These binaries are saved under temporary directories with executable permissions and spawned detached via shell commands. The code uses obfuscation techniques such as runtime assembly of hostnames and API names to evade static detection. The malicious payload is embedded within approximately 3000 lines of fake 'Analytics SDK' code, providing multiple execution paths at import time. The package name and stated functionality do not align with this behavior, confirming it as a malicious package.

The package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and disguised nature increase the risk of undetected infection in development environments relying on this package.

No official patch or remediation is currently documented. Users should immediately remove and avoid using dolyame-ui-postcssconfig version 35.8.1. Audit existing environments for usage of this package and replace it with trusted alternatives. Monitor for any suspicious activity related to spawned binaries from temporary directories. Since this is a malicious package, no legitimate fix is expected; removal is the primary mitigation.