The dolyame-ui-generateid npm package version 35.8.1 includes malicious functionality where its index.js loads a shim that dynamically constructs URLs to fetch native binary payloads from anonymous Cloudflare Workers domains. It uses covert DNS TXT-record fallback to assemble base64-encoded payload chunks from several domains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The binary is saved to temporary directories with disguised names, permissions are set to executable (0755), and the binary is spawned detached using shell commands on POSIX or Windows systems. A secondary dropper path exists in telemetry.js that similarly decodes and executes payloads. The package employs anti-analysis techniques such as split-string requires and property access to evade detection. This behavior is inconsistent with the package's declared purpose as a UI ID-generation helper and observability SDK, confirming it as a malicious package.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary native binaries from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and further malicious activity. The use of covert DNS TXT-record fallback and anti-analysis techniques complicates detection and mitigation. Since the package executes binaries detached from the main process, it may evade some runtime monitoring tools.

No official patch or remediation is currently documented. Users should immediately remove version 35.8.1 of dolyame-ui-generateid from their environments and avoid using this package. Investigate any systems where this package was installed for signs of compromise or execution of the dropped binaries. Use trusted sources for npm packages and consider scanning dependencies for malicious behavior. Monitor for updates or advisories from the package maintainers or security vendors regarding remediation.