The dolyame-ui-select npm package version 35.9.5 contains embedded malicious code that loads a secondary script (_bridge.js) which reconstructs C2 hostnames from fragmented strings. It downloads a platform-specific binary executable from these C2 servers and writes it to temporary directories with disguised filenames. The binary is made executable and launched detached from the main process. The malware uses a DNS TXT covert channel over *.dl.wel1.ru domains to maintain communication if HTTPS egress is blocked. The payload is disguised with identifiers such as 'analytics' and 'dotnet_diag' to evade detection. The malware maintains persistence by re-executing on a timer (~20455 seconds). A larger dropper variant with similar behavior is found in lib/telemetry.js under the guise of an 'analytics-sdk'.

This malicious package enables remote code execution on affected systems by downloading and executing arbitrary binaries from attacker-controlled servers. The use of covert DNS channels allows communication even in restricted network environments. The persistence mechanism ensures ongoing presence on infected hosts. This can lead to compromise of system integrity, data exfiltration, or further malware deployment. No known exploits in the wild are reported yet.

No official patch or remediation is currently available. Users should immediately remove version 35.9.5 of dolyame-ui-select from their projects and replace it with a trusted alternative or a clean version if available. Network monitoring for connections to the identified C2 domains and DNS TXT queries to *.dl.wel1.ru can help detect infections. Avoid using this package until the vendor provides an official fix or advisory.