The dolyame-ui-postcsscustomproperties npm package version 35.8.1 is a malicious package that executes code upon require() by selecting a platform-specific payload. It downloads a binary over HTTPS from Cloudflare Workers domains or reconstructs it from DNS TXT records. The binary is saved to temporary directories with executable permissions and launched detached via shell commands. The package uses runtime string splitting and assembly to hide module and host names, defeating static analysis. It impersonates a telemetry SDK and typosquats the legitimate postcss-custom-properties package to trick users.

This malicious package can execute arbitrary code on the host system with the privileges of the user running the Node.js process. The downloaded binary payload is executed without user consent, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation techniques make detection and analysis more difficult.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.8.1) of dolyame-ui-postcsscustomproperties from their projects and avoid installing packages with suspicious or typo-squatted names. Use trusted sources and verify package integrity before installation. Monitor for any unexpected network connections or execution of unknown binaries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.