The dolyame-ui-text npm package (version 35.7.4) is a malicious package that disguises itself as a React UI text component. Its main entry point requires an initialization script that acts as a binary dropper. This script reconstructs command-and-control hostnames at runtime and downloads a platform-specific payload over HTTPS, using a DNS-TXT record fallback channel for chunked payload assembly. The payload is saved to temporary directories with decoy filenames, permissions are set to executable, and it is spawned detached via shell commands. A secondary dropper in telemetry.js similarly decodes and executes an embedded payload using obfuscated code. There is no legitimate UI functionality in the package, and the obfuscation and execution paths indicate malicious intent.

This package enables remote code execution on the host system by downloading and executing arbitrary payloads from attacker-controlled servers. The malicious payload runs with the permissions of the user installing or running the package, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation and use of multiple delivery mechanisms complicate detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove the dolyame-ui-text package version 35.7.4 from their projects and replace it with trusted alternatives. Audit systems for any signs of compromise if this package was installed. Monitor for suspicious network activity related to the indicated C2 domains. Since no vendor advisory or patch is available, patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.