The dolyame-ui-popupcarousel npm package version 35.8.1 includes malicious code in its _support.js and lib/telemetry.js files. Upon requiring the package, these scripts fetch platform-specific native binaries from rotating anonymous Cloudflare Workers hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback via *.dl.wel1.ru. The payload is saved to temporary directories (/tmp or %TEMP%) using decoy filenames such as .cache_<hex> or dotnet_diag_<hex>.exe, permissions are set to executable (chmod 0755), and the binaries are spawned detached using shell commands (/bin/sh -c or cmd.exe). Sensitive API names and destination hostnames are obfuscated via string manipulation to evade static detection. The main entry point unconditionally requires _support.js, causing the malicious dropper to execute on any import of the package, enabling arbitrary code execution on the installer's host under a false telemetry SDK cover.

This malicious package enables arbitrary code execution on any system that imports dolyame-ui-popupcarousel version 35.8.1. The attacker can execute native binaries with the privileges of the user running the package, potentially leading to full system compromise or further malicious activity. The obfuscation techniques used make detection difficult, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should immediately cease using dolyame-ui-popupcarousel version 35.8.1 and remove it from their environments. Verify the integrity and provenance of npm packages before installation. Consider using package allowlists or trusted registries. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.