The dolyame-ui-scrollblock npm package version 35.8.1 includes malicious functionality embedded in its index.js, _helpers.js, and lib/telemetry.js files. These scripts reconstruct obfuscated hostnames to download platform-specific native binaries via HTTPS, save them to temporary locations with hidden or disguised filenames, set executable permissions, and spawn them detached from the parent process. Additionally, the package can retrieve payloads by resolving DNS TXT records from a specified domain, concatenating base64 chunks, and executing the resulting binary similarly. Sensitive API calls such as child_process spawning and chmodSync are string-split to evade static detection. This results in silent execution of attacker-controlled code on any system that installs and imports this package.

This malicious package enables remote code execution on the developer's machine by downloading and running arbitrary native binaries without user consent or verification. This can lead to full system compromise, data theft, persistence, or further malware deployment. The attack occurs immediately upon requiring the package, making it highly dangerous for any projects that include this dependency. There is no indication of active exploitation in the wild yet, but the potential impact is severe.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing or importing dolyame-ui-scrollblock version 35.8.1. Audit existing projects for this dependency and replace it with trusted alternatives. Employ supply chain security measures such as package integrity verification, strict dependency review, and use of package allowlists. Monitor vendor advisories for updates or official fixes. Since this is a malicious package, no legitimate fix exists within the package itself.