The dolyame-ui-swiper npm package version 35.7.7 includes a malicious init() routine in its _bridge.js entry point that triggers on require(). This routine selects an OS-specific path and downloads a native binary from multiple obfuscated Cloudflare Workers subdomains and a DNS TXT chunked-base64 fallback domain. The binary is saved under temporary directories with disguised filenames, permissioned as executable, and executed detached via shell commands. The hostnames and process identifiers are constructed at runtime to evade static detection. The downloaded binary is unrelated to the package's stated UI component purpose and is executed with the privileges of the installing process, enabling arbitrary remote code execution on the installer's host.

Installation or requiring of dolyame-ui-swiper version 35.7.7 results in arbitrary remote code execution on the host system with the privileges of the installing user. This can lead to full compromise of the affected system, unauthorized access, data theft, or further malicious activity. The malicious binary is fetched from anonymous and unverified sources, increasing risk and preventing trust validation.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring dolyame-ui-swiper version 35.7.7. Remove the package if already installed and scan affected systems for the presence of the malicious binary under temporary directories. Monitor for suspicious child processes spawned by npm or node. Check vendor advisories or trusted security sources for updates or fixes. Until a fix is available, do not use this package version.