The dolyame-ui-tabs npm package version 35.3.2 contains embedded malicious functionality. Upon requiring the package, it triggers code that reconstructs obfuscated hostnames to fetch platform-specific binary payloads from Cloudflare Workers subdomains and a DNS-TXT fallback channel. The payloads are saved under disguised filenames in temporary directories, made executable, and executed detached from the main process using shell commands. This results in arbitrary remote code execution on the host system at the time the library is loaded. Additionally, a dormant dropper with similar network discovery and execution techniques is included but not activated by default. The package falsely advertises as a React tabs component library, with no legitimate need for native binaries or DNS-TXT communication, indicating intentional malicious behavior and evasion tactics.

This malicious package enables arbitrary remote code execution on any system that installs and requires dolyame-ui-tabs version 35.3.2. The execution of fetched native binaries can compromise the host system, potentially allowing attackers to execute any code with the privileges of the user running the Node.js process. This poses a severe security risk including system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove dolyame-ui-tabs version 35.3.2 from their projects and dependency trees. Avoid installing or requiring this package version. Verify package integrity and source before installation. Consider using trusted package registries and tools that detect malicious npm packages. Monitor for any suspicious activity on systems where this package was installed.