The dolyame-ui-flag npm package version 35.7.6 includes malicious code that, upon require(), loads a script which downloads a platform-specific binary from hardcoded Cloudflare workers.dev domains with a DNS-TXT fallback via sdk.dl.wel1.ru. The binary is written to the system's temporary directory under disguised filenames, permissions are set to executable, and it is spawned detached using shell commands. The code uses obfuscation techniques such as string concatenation to evade detection. Additionally, a second dropper with the same functionality is embedded in lib/telemetry.js under the guise of an Analytics SDK. The package's stated purpose as a UI flag component does not align with this malicious behavior.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to system compromise, data theft, or further malware deployment. The execution of opaque binaries from anonymous hosts poses a significant risk of unauthorized control or damage to affected systems.

No official patch or remediation is currently documented. Users should immediately remove the affected version 35.7.6 of dolyame-ui-flag from their projects and avoid using this package. Consider auditing dependencies for similar malicious behavior. Monitor vendor advisories for updates or official remediation guidance.