The dolyame-ui-types npm package version 35.8.2 includes a malicious _helpers.js script that, upon require(), downloads a platform-specific binary from Cloudflare Workers mirrors and fallback domains. The binary is saved to a disguised path (.cache_<hex> on POSIX systems, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (0755), and it is spawned detached via shell commands (/bin/sh -c or cmd). Hostnames for the download are dynamically reconstructed from split-string arrays to evade static detection. This behavior is anomalous for a package whose name suggests it only provides type definitions, which should not require outbound network I/O or child process execution.

If installed and required, this package can execute arbitrary code on the host system by downloading and running a binary from attacker-controlled servers. This can lead to system compromise, unauthorized code execution, and potential persistence. The disguised file paths and dynamic hostname reconstruction increase the difficulty of detection and analysis.

No official patch or remediation is currently documented. Users should avoid installing or requiring version 35.8.2 of dolyame-ui-types. Consider removing the package if already installed. Monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package, replacing it with a trusted alternative or verifying package integrity before use is recommended.