The dolyame-ui-tablemobile npm package version 35.8.1 includes a malicious module that, upon being required, loads a bootstrap script which dynamically constructs URLs to fetch binary payloads from several Cloudflare Workers endpoints and fallback DNS-TXT records. These payloads are saved to temporary filesystem locations with disguised filenames, permissions are set to executable, and the payloads are executed detached via system shell commands (/bin/sh on POSIX or cmd on Windows). The main library file lib/telemetry.js contains similar base64-decoding and execution logic framed as an analytics extension, causing the payload to run when the package is imported normally. The code employs evasion techniques such as dynamic require calls, string concatenation for function names, and runtime hostname reconstruction. The downloaded payload is opaque native code unrelated to the package's stated UI table purpose, indicating malicious intent.

Users who install and require dolyame-ui-tablemobile version 35.8.1 risk execution of arbitrary native code on their systems. This can lead to compromise of the host environment, unauthorized code execution, and potential persistence. The malicious payload is delivered from external infrastructure and executed without user consent, posing a significant security risk.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove dolyame-ui-tablemobile version 35.8.1 from their dependencies and avoid using this package. Audit dependency trees for this package and replace it with trusted alternatives. Monitor for any signs of compromise if this package was previously installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.