The dolyame-ui-list npm package (version 35.2.6) includes malicious code that, upon require(), loads a script (_vendor.js) which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers domains (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) and uses a DNS TXT fallback under *.dl.wel1.ru. The code obfuscates destination hostnames and API calls using array fragment joins and dynamic member access. The downloaded executable is saved to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, given executable permissions (chmod 0755), and executed detached via shell commands. Environment variables related to telemetry are checked to disguise the behavior as telemetry SDK activity. A second copy of the dropper is embedded as lib/telemetry.js, providing an alternate execution path. The package name mimics a legitimate vendor but the behavior is inconsistent with any legitimate use, indicating malicious intent.

The malicious package can download and execute arbitrary platform-specific binaries from attacker-controlled infrastructure without integrity verification, leading to potential remote code execution on affected systems. The use of obfuscation and mimicry of legitimate telemetry SDKs may evade detection. This compromises the security of any environment that installs and runs this package version.

No official patch or remediation is currently available. Users should immediately avoid using version 35.2.6 of dolyame-ui-list. Remove the package from all environments and replace it with verified, trusted dependencies. Monitor for any signs of compromise related to this package. Since no vendor advisory or patch information is provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.