The dolyame-ui-avatar npm package (version 35.9.8) includes a malicious payload that triggers on package load. It requires a module that downloads a platform-specific executable from obfuscated Cloudflare Workers domains, with DNS-TXT fallback resolvers under *.dl.wel1.ru. The destination hostnames are dynamically constructed at runtime to evade static analysis. The downloaded binary is saved to temporary directories with disguised filenames, permissioned to be executable, and launched detached from the parent process using shell commands. A marker file is created to limit repeated execution. No hash or signature verification is performed on the downloaded binary. This behavior is unrelated to the package's declared function of providing UI avatar elements and is designed to masquerade as part of the legitimate dolyame payment SDK ecosystem.

The malicious code enables remote code execution by downloading and running an unverified binary on the host system. This can lead to unauthorized system compromise, persistence, and potentially further malicious activity. The obfuscation and runtime assembly of hostnames complicate detection and analysis, increasing risk to users who install this package.

Users should avoid using dolyame-ui-avatar version 35.9.8. Since no patch or remediation is currently available, remove this package from all environments and replace it with a verified legitimate alternative. Monitor for any signs of compromise if this package was previously installed. Verify package sources carefully to avoid similarly named malicious packages.