The dolyame-ui-textarea npm package version 35.3.4 includes a malicious dropper embedded in its main entry point and a bundled telemetry SDK. Upon loading, it constructs mirror hostnames to fetch a binary payload over HTTPS or DNS TXT records as a fallback. The payload is saved to temporary directories with disguised filenames, permissioned to be executable, and executed detached via shell commands. Environment variables and filenames are used to disguise the dropper as telemetry or analytics-related functionality. The package name suggests a UI component but contains no textarea features, only the malicious drop-and-execute behavior.

This malicious package can execute arbitrary code on the host system with the permissions of the user running the npm package. This can lead to compromise of the host environment, unauthorized code execution, and potential persistence. The disguised telemetry behavior may delay detection by developers or automated systems.

No official patch or remediation is currently documented. Users should avoid installing or using dolyame-ui-textarea version 35.3.4. Remove the package if already installed and scan affected systems for the dropped binaries and related artifacts. Monitor for suspicious processes spawned from temporary directories with disguised filenames. Check vendor advisories or npm security advisories for updates on remediation.