The ded-aa-liza-ui-components npm package version 35.8.7 includes code in index.js that loads _helpers.js, which downloads platform-specific native executables from attacker-controlled Cloudflare Workers domains and fallback DNS-TXT records under *.dl.wel1.ru. The downloaded binaries are saved to temporary directories with disguised filenames, given executable permissions, and executed detached via shell or cmd. Hostnames are dynamically reconstructed from string fragments to evade detection. The package falsely advertises itself as a React UI components library, which does not require downloading or executing native binaries from third-party infrastructure.

This malicious behavior allows execution of arbitrary native code on the host system when the package is required, potentially leading to full system compromise or unauthorized actions. The disguised download and execution mechanism can evade static detection and may be triggered without user awareness due to the package's legitimate appearance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using ded-aa-liza-ui-components version 35.8.7 and remove it from projects. Verify dependencies and use trusted package sources. Monitor for updates from the package maintainer or security advisories regarding remediation.