The dolyame-ui-tabsblock npm package (version 35.8.1) contains embedded malicious functionality that triggers on require/import. It reconstructs obfuscated hostnames at runtime to download platform-specific native executables from Cloudflare Workers subdomains. If HTTPS fetch fails, it falls back to DNS TXT record queries to assemble and decode the payload. The downloaded binary is written to the system's temporary directory with randomized filenames, permissions are set to executable, and the binary is launched detached via a shell command. The code uses string splitting and concatenation to obfuscate calls to child_process.spawn, chmodSync, and hostname APIs, mimicking a legitimate Sentry-like SDK to avoid detection. This results in silent execution of attacker-controlled native code on every import of the package.

This malicious package enables remote code execution on any system that imports it, allowing attackers to run arbitrary native code with the privileges of the importing process. The payload is dynamically fetched and executed without user consent, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and fallback mechanisms increase the likelihood of successful payload delivery and execution.

No official patch or remediation is currently documented for this package version. Users should immediately remove and avoid using dolyame-ui-tabsblock version 35.8.1. Audit dependencies for this package and replace it with trusted alternatives. Employ supply chain security measures such as verifying package integrity and using package allowlists. Monitor for any unexpected child processes or network connections related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.