The dolyame-ui-popover npm package version 35.8.7 includes a malicious payload that activates on require(). It loads an internal script (_ext.js) that dynamically constructs obfuscated URLs to download native binaries from Cloudflare Workers hosts and a DNS TXT fallback under *.dl.wel1.ru. The downloaded binaries are saved to temporary directories with misleading names, permissions are set to executable (0755), and they are executed detached from the main process using shell commands. The package also contains a telemetry.js script that duplicates these drop and execute functions. This behavior effectively allows remote code execution of attacker-controlled native code on the host system. The package name is deceptive, imitating a UI library for payments, but it serves only to deliver and run malicious code.

The malicious package enables remote code execution on the host machine by downloading and running attacker-controlled native binaries. This can lead to full compromise of the affected system, unauthorized persistence, and potential further malicious activity. Since the code executes with the privileges of the user running the npm package, it poses a significant security risk.

No official patch or remediation is currently documented. Users should immediately remove the affected version (=35.8.7) of dolyame-ui-popover from their projects and avoid installing or requiring this package. Verify dependencies to ensure this package is not included transitively. Monitor for any unusual processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates on remediation or replacement versions.