The dolyame-ui-progresscircle npm package version 35.8.1 contains malicious code that, upon loading, downloads platform-specific executables from hardcoded Cloudflare workers.dev domains and fallback *.dl.wel1.ru DNS-TXT chunked resolutions. These executables are saved to temporary directories under decoy filenames, permissioned as executable, and spawned detached using system shell commands. The package obfuscates hostnames and API references by splitting strings and base64 encoding embedded payloads to evade static analysis. Despite presenting itself as a UI progress-circle or monitoring SDK, it provides no legitimate functionality matching that description.

This package enables remote code execution on the host system by downloading and executing arbitrary binaries without user consent. This can lead to full system compromise, unauthorized access, data theft, or further malware deployment. The malicious behavior activates simply by importing or requiring the package, posing a high risk to any project that includes this dependency.

No official patch or remediation is currently documented. Users should immediately remove the dolyame-ui-progresscircle package version 35.8.1 from their projects and avoid installing or importing it. Verify dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected executables or processes spawned from temporary directories. Since no patch is available, the best mitigation is to avoid use and remove the package.