The dolyame-ui-tabslayout npm package version 35.8.1 includes embedded dropper logic in its index.js that loads lib/telemetry.js and _polyfill.js. These scripts dynamically construct obfuscated URLs pointing to Cloudflare Workers domains to download a binary payload specific to the operating system. If the primary method fails, a base64-encoded payload is retrieved via DNS TXT records from a fallback domain. The payload is saved under misleading filenames such as dotnet_diag_*.exe or .cache_*, permissions are set to executable (0755), and the binary is spawned detached using shell commands. The package uses string concatenation to assemble hostnames and API calls at runtime to evade static analysis. It masquerades as a build/deployment tool and a fake Sentry-style analytics SDK, facilitating stealthy execution of malicious code.

This malicious package can execute arbitrary binaries on the host system without user consent, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and runtime assembly of URLs and API calls make detection difficult with static scanners. The execution of OS-specific payloads increases the risk across different environments where the package might be installed.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 35.8.1 of dolyame-ui-tabslayout from their projects and avoid installing it. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected binaries or processes spawned from npm packages and restrict execution permissions where possible.