The dolyame-ui-stateutils npm package version 35.8.1 includes malicious functionality triggered on require/import. It loads a loader script (_loader.js) that dynamically constructs obfuscated URLs to fetch a platform-specific binary payload from Cloudflare Workers endpoints and DNS TXT record fallback domains. The payload is saved to temporary directories under names resembling system tools, permissioned for execution, and launched detached via shell commands. The package's metadata falsely claims it is a monitoring SDK with telemetry opt-out environment variables, but this is a cover story unrelated to its actual malicious behavior. The package also implements a rate-limiting cache to throttle repeated fetches, indicating stealth and persistence considerations.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution and system compromise. The obfuscation and dynamic URL assembly complicate detection and analysis. The disguised payload filenames and detached execution increase stealth. Since the payload is fetched from external sources, it may be updated or changed dynamically, increasing risk. No known exploits in the wild are reported yet.

No official patch or remediation guidance is currently available. Users should avoid using version 35.8.1 of dolyame-ui-stateutils and remove it from their projects if present. Monitor dependency sources carefully and prefer packages from trusted maintainers. Since this is a malicious package, replacing it with a legitimate alternative or removing it entirely is recommended. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.