The dolyame-ui-pagination npm package version 35.2.5 includes a malicious dropper in its index.js that loads a polyfill script executing immediately. This dropper constructs destination hostnames at runtime to evade static detection and downloads platform-specific binaries from Cloudflare Workers endpoints, saving them to temporary directories under disguised filenames with executable permissions, then spawning them detached via shell commands. A fallback covert channel uses DNS TXT record resolution from domains under wel1.ru to retrieve base64-encoded executable buffers if HTTPS mirrors fail. A sibling module contains similar dropper code but is not directly invoked from the main entrypoint. The fetched code is opaque and unrelated to the package's intended UI pagination purpose.

The malicious code enables remote code execution on the host system by downloading and executing arbitrary binaries from attacker-controlled infrastructure. This compromises system integrity and confidentiality. The use of covert DNS channels for fallback code retrieval increases stealth and persistence. The package's legitimate functionality is a UI pagination component, so the malicious behavior is unexpected and deceptive.

No official patch or remediation is currently documented. Users should immediately remove and avoid using version 35.2.5 of dolyame-ui-pagination. Verify dependencies for this package and replace with trusted alternatives. Monitor for suspicious network activity related to the described domains and binaries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.