The dolyame-ui-money npm package version 35.6.1 includes malicious functionality in its index.js file that unconditionally loads a _bridge.js script. This script downloads a native executable from dynamically assembled Cloudflare Workers hostnames, with a DNS-TXT base64 fallback via *.dl.wel1.ru. The executable is written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, given executable permissions, and spawned detached via shell commands. Execution is throttled by a state file and respects a DO_NOT_TRACK flag to evade inspection environments. The malicious payload runs with the privileges of the user installing or requiring the package, posing a significant security risk.

The malicious code executes attacker-controlled native binaries with the privileges of the user running require() on the package, potentially allowing arbitrary code execution, persistence, and further compromise of the host system. The use of obfuscation and evasion techniques complicates detection and analysis. This behavior violates the expected functionality of the package and can lead to severe security breaches on affected systems.

No official patch or remediation is currently documented for this package version. Users should immediately remove and avoid using dolyame-ui-money version 35.6.1. Audit and verify all dependencies for similar malicious behavior. Consider using trusted package sources and tools that detect malicious npm packages. Monitor for updates or advisories from the package maintainers or security vendors regarding remediation.