The dolyame-ui-loader npm package (version 35.1.5) includes code in its index.js that triggers a platform-specific binary download from obfuscated *.workers.dev domains, with a DNS-TXT fallback from *.dl.wel1.ru. The downloaded binary is saved to temporary directories with disguised names, given executable permissions, and executed detached via shell commands. The package falsely presents itself as a UI toolkit and uses cover-story identifiers and telemetry opt-out environment variables to disguise the malicious dropper as benign telemetry activity.

This malicious behavior allows execution of arbitrary native code on the host system without user consent or legitimate need, potentially leading to full system compromise or unauthorized actions. The package's disguise and obfuscation techniques increase the risk of unnoticed infection in environments using this package version.

No official patch or remediation is currently documented. Users should immediately stop using dolyame-ui-loader version 35.1.5 and remove it from their environments. Avoid installing this package from untrusted sources. Monitor for any unusual execution of binaries from temporary directories and consider using package integrity verification tools. Check vendor advisories or npm security advisories for updates or official fixes.