The dolyame-ui-pie npm package version 35.5.3 includes malicious code in its _support.js file that triggers asynchronous initialization to download platform-specific binaries from Cloudflare Workers hosts and multiple dl.wel1.ru subdomains. The hostnames are dynamically constructed at runtime to evade detection. The downloaded binaries are saved to temporary directories with disguised filenames (e.g., dotnet_diag, .cache_), permissions are set to executable, and the binaries are launched detached via shell commands. The package uses dynamic require and property access techniques to evade static scanners. This malicious behavior activates every time the package is required, despite the package advertising itself as a React UI component library.

The malicious code results in execution of attacker-controlled binaries on the host system whenever the package is required. This can lead to unauthorized code execution, potential system compromise, persistence, and further malicious activity. The binaries are downloaded from attacker-controlled infrastructure, increasing risk of payload updates or additional malicious modules.

No official patch or remediation is currently available for this malicious package version. Users should immediately remove version 35.5.3 of dolyame-ui-pie from their projects and avoid installing or requiring this package. Use trusted sources and verify package integrity before installation. Monitor for updates from the package maintainer or npm advisories for any future remediation.