The dolyame-ui-tooltip npm package (version 35.8.8) includes malicious functionality in its main entry point (index.js). It unconditionally requires a module that selects a platform-specific endpoint and downloads an opaque binary from obfuscated Cloudflare Workers hosts with a DNS-TXT fallback to a Russian domain. The binary is saved under decoy filenames, permissioned, and executed via platform-specific shell commands. The package uses string splitting and concatenation to hide network addresses and the use of the child_process module from static analysis. This behavior is inconsistent with the package's advertised purpose and enables remote code execution on the host during installation.

The malicious code allows an attacker to execute arbitrary code on the host system where the package is installed, potentially compromising the entire system. This represents a severe security risk as it can lead to full host compromise. There are no known exploits in the wild at this time, but the capability for remote code execution is critical.

No official patch or remediation is currently available. Users should avoid installing or using version 35.8.8 of dolyame-ui-tooltip. Verify package integrity and source before installation. Monitor vendor advisories or npm security announcements for updates or removal of the malicious package.