The dolyame-ui-grid npm package (version 35.7.4) includes malicious functionality in its index.js and _polyfill.js files. Upon requiring the package, it downloads a platform-specific binary from hardcoded Cloudflare Workers domains and fallback DNS-TXT chunked hosts under the dl.wel1.ru domain. This binary is saved to the system's temporary directory with a disguised name, permissions are set to executable, and it is spawned detached via shell commands. The code is obfuscated by assembling hostnames at runtime and uses a file mtime to control re-execution cadence. A parallel dropper exists but is not reachable from the main require graph. The downloaded binary is opaque, unverified, and the execution occurs unconditionally on module load, indicating clear malicious intent.

This malicious package can lead to arbitrary code execution on any system that installs and requires dolyame-ui-grid version 35.7.4. The downloaded binary's behavior is unknown but could include data theft, system compromise, or further malware deployment. Because execution happens automatically on module load, any dependent project or user is at risk without explicit action.

No official patch or remediation is currently available. Users should immediately remove and avoid using dolyame-ui-grid version 35.7.4. Audit dependencies for this package and replace it with a trusted alternative. Monitor for any unexpected binaries or processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates on remediation.