The dolyame-ui-icon npm package version 35.7.5 includes malicious functionality embedded in its index.js and lib/telemetry.js files. Upon requiring the module, it downloads a platform-specific binary from dynamically constructed Cloudflare Workers URLs, writes it to a temporary path under a decoy filename, sets executable permissions (chmod 0755 on Unix), and executes it detached via shell commands. To evade static analysis, sensitive Node.js API calls are obfuscated by string splitting. Additionally, a DNS TXT-record covert channel over *.dl.wel1.ru subdomains is used as a fallback mechanism to reassemble a base64-encoded payload. The telemetry component mimics a Sentry-like SDK but contains the same dropper primitives, allowing attacker-controlled payloads to execute arbitrary code on the host system during module load.

This malicious package enables arbitrary code execution on the host system of any user who installs or requires dolyame-ui-icon version 35.7.5. The attacker can deliver and execute arbitrary binaries, potentially compromising the entire system, stealing data, or performing further malicious activities. The use of obfuscation and covert DNS channels complicates detection and analysis.

No official patch or remediation is currently documented. Users should immediately avoid installing or using dolyame-ui-icon version 35.7.5. Remove the package from any affected systems and replace it with trusted alternatives. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates on remediation.