The dolyame-ui-iconloaderhoc npm package at version 35.8.1 includes malicious functionality triggered upon requiring the package. It performs two dropper paths that retrieve platform-specific binaries from hardcoded Cloudflare workers.dev URLs with a DNS-TXT fallback via subdomains of dl.wel1.ru. The binaries are saved to temporary directories (/var/tmp or %TEMP%), permissions are set to executable (0755), and the binaries are executed detached using system shell commands (/bin/sh -c or cmd.exe). The code employs string-splitting and dynamic property access to evade static detection, framing the behavior as analytics or telemetry. The payloads are unpinned and unverified, and the infrastructure serving them is anonymous and unrelated to the legitimate publisher, indicating a supply chain compromise or malicious package insertion.

This malicious package can execute arbitrary platform-specific binaries on the host system with the privileges of the running process. This can lead to unauthorized code execution, potential system compromise, data theft, or persistence. The use of obfuscation and anonymous infrastructure complicates detection and attribution. Since the payloads are opaque and unverified, the exact impact depends on the fetched binaries but poses a high risk to affected systems.

Users should immediately avoid using dolyame-ui-iconloaderhoc version 35.8.1 and remove it from their environments. Since no patch or remediation is provided, the best mitigation is to replace this package with a trusted alternative or an unaffected version if available. Monitor for any signs of compromise on systems where this package was used. Verify package integrity and source authenticity before installation in the future.