The dolyame-ui-buttonstore npm package at version 35.8.1 acts as a dropper malware. Upon loading, its index.js requires setup.js, which selects a platform-specific binary path and fetches encrypted payload bytes over HTTPS from dynamically assembled hostnames. These hosts include multiple workers.dev domains. The payload is written to hidden files in temporary directories with executable permissions and executed detached via shell commands. If HTTPS retrieval fails, a fallback mechanism uses DNS TXT records from dl.wel1.ru subdomains to reconstruct the payload. The package metadata falsely claims to provide TypeScript definitions and mimics a known brand, but the tarball contains only the dropper and a telemetry library. The empty author field and obfuscated runtime destinations indicate deliberate evasion and malicious intent.

This package enables remote code execution on the host system by downloading and executing arbitrary binaries without user consent. The use of hidden temporary files and detached execution complicates detection and forensic analysis. The DNS TXT fallback increases resilience against network blocking. This can lead to system compromise, persistence, and potentially further malicious activities depending on the payload delivered.

No official patch or remediation is available for this malicious package. Users and organizations should immediately remove dolyame-ui-buttonstore version 35.8.1 from their environments and avoid installing it. Employ supply chain security measures such as verifying package provenance, using trusted registries, and scanning dependencies for malicious content. Monitor for indicators of compromise related to the described domains and file patterns. Since this is a malicious package, remediation involves removal and prevention rather than patching.