The dolyame-ui-contextmenu npm package version 35.8.1 includes a malicious _polyfill.js script that, upon requiring the package, downloads platform-specific binaries from hardcoded, anonymous Cloudflare Workers subdomains. These binaries are saved under misleading filenames in temporary directories, given executable permissions (chmod 0755), and executed detached via cmd.exe or /bin/sh. Hostnames for the download endpoints are dynamically constructed from array fragments to evade static analysis. Additionally, a covert channel using base64-encoded DNS TXT records under the domain *.dl.wel1.ru is used to retrieve payloads if HTTPS connections are blocked. The payloads are opaque attacker-controlled code executed on the installer's host, representing a supply chain compromise.

This malicious package enables remote code execution on the host machine during installation or usage, allowing attackers to run arbitrary code with the privileges of the user installing the package. This can lead to system compromise, data theft, persistence, or further lateral movement within the environment. The obfuscation and covert channel techniques increase the difficulty of detection and mitigation.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove and avoid using dolyame-ui-contextmenu version 35.8.1. Verify the integrity of dependencies before installation and consider using trusted package sources or lockfiles. Monitor for any unexpected network connections to the described domains and investigate any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.