The dolyame-ui-progressline npm package version 35.8.1 includes malicious functionality triggered on require. It loads a shim script that fetches a platform-specific binary from hardcoded Cloudflare Workers URLs or a DNS TXT record fallback, writes it to a temporary file with a deceptive name, sets executable permissions, and executes it detached from the main process. A secondary dropper path in the telemetry module decodes base64 chunks fetched via DNS TXT fallback, writes an extension to disk, sets permissions, and executes it if the primary shim fails. The code obfuscates critical strings by concatenation to evade static analysis. The package falsely claims to provide telemetry with opt-out tokens but performs no legitimate telemetry, only remote binary retrieval and execution on the host.

This malicious package can execute arbitrary code on the host machine during installation or runtime by downloading and running remote binaries. This behavior can lead to full system compromise, unauthorized access, data theft, or further malware deployment. The deceptive naming and obfuscation techniques hinder detection by static scanners. There is no indication of active exploitation in the wild yet, but the impact of successful execution is severe.

No official patch or remediation is currently available. Users and organizations should avoid using dolyame-ui-progressline version 35.8.1. Remove the package from any environments where it is installed. Employ supply chain security measures such as verifying package integrity, using trusted package sources, and monitoring for suspicious network activity related to package installations. Monitor vendor advisories for any future updates or patches.