The dolyame-ui-badge npm package (version 35.4.4) loads a _bootstrap.js script that downloads a native executable from runtime-assembled Cloudflare Workers domains with a DNS TXT-record fallback channel. The downloaded binary is saved to temporary directories with disguised filenames, permissioned as executable, and spawned detached via shell commands. Hostnames are obfuscated by splitting and joining strings at runtime. Despite comments suggesting SHA-256 verification and opt-out features, no actual verification or opt-out code is present. The package’s advertised UI badge functionality does not require native binaries, indicating the binary download and execution is malicious.

This malicious behavior allows arbitrary native code execution on the host system when the package is required, potentially leading to full system compromise depending on the binary's payload. The lack of signature or hash verification means the downloaded binary could be altered or replaced by an attacker, increasing risk. The obfuscation and fallback mechanisms complicate detection and blocking.

No official patch or remediation is currently documented. Users should immediately remove and avoid using dolyame-ui-badge version 35.4.4. Audit systems for presence of this package and any suspicious binaries named like dotnet_diag_*.exe or .cache_* in temporary directories. Monitor for unexpected spawned processes from npm packages. Consider blocking network requests to the identified Cloudflare Workers domains and the *.dl.wel1.ru fallback domain. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.