The dolyame-ui-react-version-switch npm package version 35.6.1 includes a malicious dropper in its index.js file. Instead of providing legitimate UI functionality, it unconditionally requires a _vendor.js module that dynamically constructs obfuscated URLs to fetch binary payloads over HTTPS from multiple suspicious hosts. It uses DNS-TXT record fallback to evade HTTPS filtering. The fetched binaries are saved to temporary locations with disguised filenames, made executable on POSIX systems, and executed via shell commands without any hash or integrity verification despite a misleading comment claiming SHA-256 checks. The package's advertised React UI interface is a no-op stub, serving as a cover for the malicious behavior.

This malicious package can lead to arbitrary code execution on the host system by downloading and running unverified executables. This poses a significant risk of system compromise, data theft, or further malware installation. Because the payload is fetched from external, obfuscated sources and executed without integrity checks, it can evade detection and deliver a wide range of malicious payloads.

No official patch or remediation is currently available for this malicious package. The best mitigation is to avoid using the dolyame-ui-react-version-switch package version 35.6.1 and remove it from any environments where it is installed. Use trusted sources and verify package integrity before installation. Monitor for and block network connections to the identified suspicious domains if possible.