The dolyame-ui-island npm package (version 35.7.4) includes a malicious payload in its setup.js file, which is loaded by index.js upon require(). This payload dynamically constructs hostnames to evade static detection and downloads a platform-specific binary from obfuscated Cloudflare Workers domains and DNS-TXT fallback channels under the wel1.ru domain. The binary is saved to a randomized temporary file path mimicking diagnostic tools, made executable, and executed in a detached shell process. The package's name and comments attempt to disguise its true intent by impersonating a payments UI library and referencing benign-sounding analytics and content negotiation terms, but it contains no legitimate payment-related functionality.

This malicious package can execute arbitrary code on the host system by downloading and running an unknown binary, potentially leading to full system compromise, data theft, or further malware deployment. The obfuscation and runtime hostname assembly complicate detection and analysis. No known exploits in the wild are reported yet, but the capability for remote code execution is present.

No official patch or remediation is currently available. Users should immediately remove version 35.7.4 of the dolyame-ui-island package from their environments and avoid installing or using this package. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any unusual activity related to this package and consider using tools that detect malicious npm packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.