The dolyame-ui-dataqa npm package (version 35.8.1) includes malicious functionality where, upon requiring index.js, it loads scripts (_polyfill.js and lib/telemetry.js) that download native binaries from Cloudflare Workers subdomains with a DNS TXT fallback to *.dl.wel1.ru. These binaries are assembled at runtime to evade static scanners, saved to temporary directories with cover-story filenames, permissioned to execute, and then spawned detached via shell commands. The lib/telemetry.js script contains a duplicate mechanism to ensure execution even if _polyfill.js is removed. The package falsely presents itself as a UI/data QA tool, but its loader-dropper behavior indicates malicious intent.

This malicious package can execute arbitrary native code on the host system by downloading and running binaries without user consent. This can lead to system compromise, unauthorized persistence, and potential further malicious activities. The deceptive nature and runtime assembly of execution paths make detection and prevention challenging.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.1 of dolyame-ui-dataqa from their environments and avoid using this package. Employ dependency scanning tools to detect and block this malicious package. Monitor for any unusual processes spawned from temporary directories. Since this is not a cloud service, remediation depends on user action.