The dolyame-ui-themes npm package version 35.6.3 includes a loader.js that reconstructs C2 hostnames from split string arrays to evade static detection. It contacts multiple attacker-controlled domains and retrieves further endpoints via DNS TXT records. The loader downloads a platform-specific binary via HTTPS, writes it to temporary directories under disguised filenames, sets executable permissions (chmod 755), and executes it detached via shell commands. Dangerous Node.js APIs are dynamically loaded using runtime string concatenation to hinder detection. A sibling module, lib/telemetry.js, contains similar dropper functionality. The package name mimics a legitimate payment integration ecosystem, indicating a typosquatting attack vector. Installing or requiring this package results in execution of opaque attacker-controlled binaries on the host system.

Installation or requiring of the affected package version results in execution of attacker-controlled binaries on the host system, potentially leading to full system compromise or unauthorized actions. The malicious code uses obfuscation and covert channels to evade detection and maintain persistence. This poses a significant risk to any environment where this package is installed.

No official patch or remediation guidance is currently available. Users should avoid installing or requiring the dolyame-ui-themes package version 35.6.3. Verify package authenticity before installation and prefer official sources. Monitor for suspicious activity related to this package and remove it if found. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.