The dolyame-ui-layout npm package version 35.9.8 includes embedded malicious functionality that triggers on every require() call. It loads a platform-specific script that constructs domain names at runtime to fetch a native binary payload over HTTPS from Cloudflare Workers hosts, with a DNS-TXT chunked-base64 fallback from a *.dl.wel1.ru domain. The binary is written to temporary system directories under names resembling legitimate system diagnostic files, permissions are set to executable (chmod 0755), and the binary is executed detached from the parent process using shell commands on POSIX or cmd on Windows. The package uses obfuscation techniques such as string concatenation to hide dangerous API and module names. No publisher verification, hash, or signature validation is performed on the downloaded payload, allowing arbitrary code execution immediately upon module import. A secondary file, lib/telemetry.js, contains redundant dropper code with similar behavior. This constitutes a malicious package rather than a traditional vulnerability.

This package enables arbitrary code execution on any system that imports it, by downloading and running an unverified native binary payload. The payload runs with the permissions of the importing process and is executed immediately upon module load, potentially leading to full system compromise. The lack of integrity checks or publisher verification increases the risk of supply chain attacks. The obfuscation and use of multiple delivery mechanisms complicate detection and mitigation.

No official patch or remediation guidance is provided. Users should immediately remove and avoid using version 35.9.8 of dolyame-ui-layout. Audit dependencies for this package and replace it with trusted alternatives. Employ supply chain security measures such as verifying package provenance and integrity before use. Monitor for any signs of compromise if this package was previously installed.