The dolyame-ui-utils npm package version 35.6.7 includes a malicious payload in its _polyfill.js and lib/telemetry.js files. When the package is required, it selects a platform-specific URL and fetches a binary payload from obfuscated Cloudflare Workers domains, with a fallback DNS-TXT channel. This binary is written to temporary storage locations, given executable permissions, and executed detached from the main process using shell commands. The package does not verify the hash or signature of the downloaded payload, and the download sources are unrelated to the package publisher. The telemetry.js file contains a secondary dropper with additional evasion techniques, including dynamic require and chmod calls. The presence of an analytics_state marker file and a DISABLE_TELEMETRY environment variable are used to mask the malicious behavior.

The malicious code enables arbitrary code execution on systems that install and require the affected package version. This can lead to unauthorized execution of potentially harmful binaries, compromising system integrity and security. The lack of signature or hash verification increases the risk of executing untrusted code. The evasion techniques and obfuscation complicate detection and analysis.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using dolyame-ui-utils version 35.6.7. Remove the package from any affected environments and replace it with a trusted alternative. Monitor for any unexpected binaries or processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates or official remediation guidance.