The dolyame-ui-stepper npm package version 35.7.5 includes malicious functionality triggered on require(). Its index.js loads a shim.js that reconstructs obfuscated hostnames and fetches a platform-specific native binary via HTTPS. The binary is saved to a temporary location with a disguised name (e.g., dotnet_diag_<hex>.exe on Windows), permissions set to executable, and then spawned detached using shell commands. Additionally, a duplicate dropper is present in lib/telemetry.js under an 'Analytics SDK' guise but is not currently invoked. The external hosts used for fetching are obfuscated through string splitting and include fallback DNS-TXT base64 retrieval methods. This results in automatic remote code execution without user consent.

This malicious package enables automatic execution of downloaded native binaries on the host system whenever the package is imported, potentially leading to unauthorized code execution, persistence, and further compromise. The disguised filenames and obfuscated hostnames indicate an attempt to evade detection. There is no indication of known exploits in the wild yet, but the risk of compromise is significant due to the automatic and silent execution.

No official patch or remediation is currently documented. Users should immediately avoid using version 35.7.5 of dolyame-ui-stepper. Remove the package from all projects and replace it with a trusted alternative. Monitor for any unexpected processes or files resembling the described binaries. Since this is a malicious package, standard patching does not apply; remediation involves removal and avoidance.