The dolyame-ui-footer npm package version 35.5.8 includes a malicious runtime script (_runtime.js) that dynamically constructs hostnames to fetch a binary payload over HTTPS from three hardcoded Cloudflare Workers domains. It uses a DNS TXT record chunked fallback mechanism to reconstruct a base64-encoded payload from multiple domains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. On POSIX systems, the binary is saved to /var/tmp with a disguised filename, permissions set to executable, and spawned detached via a shell command. On Windows, it is saved to the TEMP directory with a disguised executable name and executed. This malicious behavior is concealed under the guise of a UI/footer component, which does not align with the package's declared functionality.

The malicious code enables remote code execution on the host system by downloading and executing a binary payload without user consent or awareness. This can lead to unauthorized system compromise, persistence, and potentially further malicious activities depending on the payload's capabilities. The supply chain nature of this threat means that any project depending on this specific package version may be at risk.

No official patch or remediation guidance is provided in the available data. Users should avoid using dolyame-ui-footer version 35.5.8 and remove it from their projects. It is recommended to audit dependencies for this package and replace it with a trusted alternative or a clean version if available. Monitor for updates from the package maintainer or npm security advisories for any official fixes.