The dolyame-ui-contenteditable npm package version 35.8.1 includes malicious functionality triggered on require(). The main index.js loads a compatibility script that reconstructs attacker-controlled Cloudflare Workers hostnames from split strings, selects an OS/architecture-specific remote binary path, downloads the binary, writes it to /tmp or %TEMP% with disguised filenames, sets executable permissions (chmod 0755 on POSIX), and spawns the binary detached via shell commands. If HTTPS egress is blocked, a fallback channel uses DNS TXT records from numeric subdomains of dl.wel1.ru to reassemble the binary. Additionally, a parallel dropper in lib/telemetry.js decodes base64 chunks, writes an executable to an extension path, sets permissions, and spawns it under an analytics SDK cover. The package does not enforce version pinning or hash verification and uses environment checks and TTL stamp files to hinder analysis.

This malicious package enables remote code execution on systems that install and require it, allowing attackers to run arbitrary binaries downloaded from attacker-controlled infrastructure. The fallback DNS TXT record channel provides resilience against network egress restrictions. The execution of attacker-controlled binaries can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove dolyame-ui-contenteditable version 35.8.1 from their projects and dependency trees. Avoid installing or requiring this package. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unexpected binaries or processes spawned from npm packages.