The dolyame-ui-filter npm package version 35.5.3 contains malicious code that dynamically constructs destination hostnames at runtime to evade static analysis. It connects to Cloudflare Worker endpoints and uses DNS TXT records as a covert channel to download a platform-specific binary from anonymous hosts. The binary is saved under decoy filenames (e.g., dotnet_diag_<hex>.exe on Windows) and executed detached from the main process. The package falsely claims this behavior is related to telemetry, but it is a dropper mechanism for executing opaque binaries, indicating malicious intent.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or awareness, potentially leading to system compromise, persistence, or further payload delivery. The use of covert channels and decoy filenames complicates detection and forensic analysis.

No official patch or remediation is indicated. Users should avoid using the dolyame-ui-filter package version 35.5.3. Remove any installations of this package and audit systems for the presence of suspicious binaries named like dotnet_diag_<hex>.exe or .cache_<hex>.exe. Employ supply chain security measures such as verifying package provenance and using trusted sources.