The dolyame-ui-skeleton npm package (version 35.2.5) includes a malicious load-time binary dropper. Its index.js requires a _vendor.js module that downloads a platform-specific binary from obfuscated Cloudflare Workers domains, writes it to a hidden cache path, sets executable permissions, and spawns it detached via shell commands. To evade detection, the package reconstructs destination hostnames at runtime and uses DNS TXT queries to retrieve base64-encoded binary chunks from multiple domains as a fallback mechanism, bypassing HTTPS egress filtering. The dropped binaries use filenames mimicking legitimate system or analytics files. There is no legitimate reason for a UI component package to perform these actions, confirming the package's malicious nature.

Users who install or run the affected version of dolyame-ui-skeleton (35.2.5) risk executing unauthorized native binaries on their systems, potentially leading to system compromise, data theft, or further malware deployment. The covert delivery mechanisms and obfuscation techniques make detection and blocking difficult, increasing the risk of undetected malicious activity.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.2.5) of dolyame-ui-skeleton from their projects and avoid installing this package. Employ strict package source verification and scanning to prevent use of this malicious package. Monitor for updates from the package maintainer or npm advisory for any official fixes or removals.