The dolyame-ui-attachfile npm package version 35.8.1 includes malicious import-time code in its main modules that dynamically reconstructs hostnames and API calls to evade static analysis. It downloads opaque binary payloads from three hardcoded Cloudflare Workers domains and fallback DNS-TXT resolved domains under wel1.ru, writes these payloads to temporary directories with disguised names, sets executable permissions, and executes them detached via shell commands. The package masquerades as a fintech-related tool but acts as a native binary loader without hash or signature verification and without user consent. The external hosts used for payload delivery are not documented or legitimate endpoints for the package's stated functionality. There is no known patch or vendor advisory available at this time.

This malicious package can lead to arbitrary code execution on the host system by downloading and running unsigned native binaries without user consent. This behavior can compromise system integrity and potentially lead to further malicious activity. The obfuscation techniques used hinder detection by static scanners, increasing the risk of unnoticed compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using the dolyame-ui-attachfile package version 35.8.1. Remove any installations of this package from your environment and consider scanning for any dropped payloads or spawned processes related to this package. Monitor for updates from the package maintainers or security advisories regarding remediation.