The dolyame-ui-cardlogo npm package version 35.8.1 includes a malicious payload in its index.js file that requires a polyfill script. This polyfill script downloads a platform-specific binary from several dynamically reconstructed hostnames, with fallback DNS TXT record resolutions pointing to suspicious domains under wel1.ru. The binary is saved to temporary directories with filenames mimicking legitimate diagnostic tools and executed with elevated permissions. The package uses obfuscation techniques such as string-array concatenation to hide the hostnames and disguises the malicious activity under telemetry and analytics function names, which do not correspond to the package's legitimate UI purpose.

The malicious code enables remote code execution on the host system by downloading and running an external binary without user consent. This can lead to unauthorized system compromise, persistence, and potentially further malicious activities. The disguised filenames and obfuscation techniques increase the difficulty of detection by standard security tools.

No official patch or remediation is currently available for this package version. Users should immediately remove version 35.8.1 of dolyame-ui-cardlogo from their projects and avoid installing it. Consider auditing dependencies for similar malicious packages and use trusted sources. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals.