The dolyame-ui-inputrange npm package version 35.8.1 includes malicious functionality that reconstructs obfuscated hostnames to download a binary payload from Cloudflare Workers and a fallback DNS-TXT domain (*.dl.wel1.ru). This binary is written to temporary directories with disguised filenames and executable permissions, then executed detached via a shell command. The package's telemetry module duplicates these dropper behaviors to maintain persistence even if the initial loader is removed. The malware uses runtime string assembly and environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) to evade static detection and prevent repeated execution. No native source code for the binary is included in the package, and the fetched payload is opaque.

The malicious code enables remote code execution on the host system by downloading and running an opaque binary payload with elevated permissions. This can lead to unauthorized system compromise, persistence, and potential further malicious activity. The use of obfuscation and evasion techniques complicates detection and removal.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove the affected version 35.8.1 of dolyame-ui-inputrange from their environments. Avoid installing or using this package version. Monitor for any unexpected processes or binaries in temporary directories named with .cache_<hex> or dotnet_diag_<hex>.exe patterns. Consider blocking network connections to the identified domains and Cloudflare Workers hostnames used by the malware. Check vendor advisories or trusted security sources for updates or fixes.