The npm package dolyame-ui-mediainfohoc version 35.8.1 includes embedded malicious code that, upon being required, selects a platform-specific asset and downloads an opaque binary from three hardcoded Cloudflare Workers domains with DNS-TXT fallback via *.dl.wel1.ru subdomains. The binary is written to a temporary directory under a hidden or executable name, permissions are set to executable (chmod 0755), and it is spawned detached using shell commands. The code uses string concatenation and array joins to evade static detection and falsely labels this behavior as telemetry. A duplicate dropper is embedded in lib/telemetry.js, wrapped in a fake analytics SDK, which decodes a base64 buffer, writes it to disk, sets permissions, and executes it similarly. Both droppers are independent and shipped within the same package, enabling remote code execution when the package is imported.

This malicious package enables remote code execution on any system that installs and requires dolyame-ui-mediainfohoc version 35.8.1. The dropped binaries are opaque and fetched from attacker-controlled infrastructure, potentially allowing arbitrary code execution, persistence, and further compromise of the host system. The obfuscation and dual dropper design increase the difficulty of detection and removal.

No official patch or remediation is currently documented for this package. Users should immediately remove dolyame-ui-mediainfohoc version 35.8.1 from their projects and dependency trees. Avoid installing or requiring this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected network connections to the indicated domains and scan systems for dropped binaries in temporary directories. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.