The dolyame-ui-notification package (version 35.5.4) masquerades as a UI notification toolkit but contains malicious code that, upon loading, randomly selects one of four obfuscated Cloudflare workers.dev hosts reconstructed at runtime. It also uses a DNS-TXT fallback channel over *.dl.wel1.ru to reassemble base64 fragments from sequential subdomain TXT records. The package downloads platform-specific native binaries (e.g., /pkg/package.exe) to temporary directories with diagnostic-tool-like filenames, sets executable permissions, and spawns these binaries detached via shell or command prompt. This behavior indicates a supply-chain dropper designed to execute arbitrary native code, which is inconsistent with the package's declared purpose.

The malicious package can execute arbitrary native code on the host system by downloading and running platform-specific binaries covertly. This can lead to unauthorized code execution, potential system compromise, and persistence. The obfuscation and use of covert DNS-TXT channels complicate detection and analysis.

No official patch or remediation guidance is provided. Users should avoid using version 35.5.4 of dolyame-ui-notification. Remove the package from affected environments and replace it with trusted alternatives. Monitor for any signs of compromise related to this package. Since this is a supply-chain threat, verify the integrity of dependencies before use.