The dolyame-ui-action npm package version 35.6.3 includes a malicious module (_support.js) that downloads a binary payload from dynamically reconstructed Cloudflare Workers domains and a fallback DNS TXT record under *.dl.wel1.ru. The payload is saved to temporary directories with disguised names, permissions are set to executable, and it is spawned detached via shell commands. The loader is wrapped in a silent try/catch to avoid errors surfacing. Additionally, a telemetry module bundles similar dropper primitives enabling an alternate execution path. The delivered binary is opaque and not pinned to a known hash or signature, complicating detection and analysis. This behavior constitutes a malicious package infection vector in the npm ecosystem.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent, potentially leading to unauthorized code execution, persistence, and further compromise. The obfuscation and silent failure handling increase the difficulty of detection and mitigation. There is no indication of active exploitation in the wild yet, but the presence of a dropper in a widely used package repository poses a significant risk to users who install this specific version.

No official patch or remediation guidance is currently available for this malicious package version. Users should avoid installing or using dolyame-ui-action version 35.6.3. If already installed, remove the package and any suspicious binaries found in temporary directories. Monitor for unusual process executions spawned from temporary locations. Check the vendor or npm advisories for updates or official remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.