The dolyame-ui-table npm package version 35.5.4 includes malicious functionality in its main entry file (_compat.js). It dynamically reconstructs URLs to Cloudflare Workers and a fallback DNS-TXT host to download a platform-specific binary executable. The binary is saved to temporary directories with obfuscated filenames and permissions set to executable (chmod 755). It is then spawned detached using shell commands (/bin/sh -c or cmd), enabling execution outside the normal Node.js process. This runtime assembly of URLs and file paths is designed to evade detection by static analysis tools. The package's stated purpose as a UI table toolkit does not justify native binary downloads or subprocess execution, indicating clear malicious intent.

If installed and required, the package will download and execute a potentially malicious native binary on the host system, which can lead to arbitrary code execution. This can compromise the host environment, potentially allowing attackers to execute unauthorized commands, persist on the system, or exfiltrate data. The disguised naming and detached execution make detection and removal more difficult.

No official patch or remediation is currently documented. Users should immediately avoid using version 35.5.4 of dolyame-ui-table. Remove the package from all environments and replace it with a trusted alternative. Monitor for any signs of compromise if this version was previously installed. Since no patch is available, the best mitigation is to uninstall and not use this package version.