The dolyame-ui-accordion npm package version 35.2.6 includes malicious behavior where requiring the package triggers an unconditional load of a _vendor.js script. This script downloads a platform-specific binary from obfuscated Cloudflare workers.dev endpoints, with a DNS TXT-record base64 fallback via *.wel1.ru. The binary is saved to temporary directories under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), permissions are set to executable (chmod 0755), and it is spawned detached using shell commands (/bin/sh -c or cmd.exe). Hostnames for the download are dynamically assembled at runtime from split string fragments to evade static detection. The naming conventions and environment variables used attempt to disguise this activity as diagnostic telemetry, which is inconsistent with the package's advertised purpose as a React accordion UI component.

This behavior allows arbitrary native code execution on the host system when the package is required, potentially leading to system compromise, data theft, or further malware deployment. The malicious code bypasses typical static analysis by obfuscating download endpoints and disguising the payload as telemetry or diagnostics. Users installing or requiring this package version are at risk of executing unauthorized code without their knowledge.

No official patch or remediation is currently documented for this package version. Users should avoid installing or using dolyame-ui-accordion version 35.2.6. It is recommended to remove this package from projects and replace it with a trusted alternative. Monitor vendor advisories or trusted security sources for updates or fixes. Since this is a malicious package, no legitimate use justifies the runtime download and execution behavior.