The dolyame-ui-slider npm package (version 35.3.7) includes a malicious payload in its index.js file that loads a _bootstrap.js script. This script dynamically selects a platform-specific asset path and downloads a binary from one of three Cloudflare Workers hosts, with a DNS-TXT chunked-base64 fallback to several suspicious Russian domains. The binary is written to /var/tmp or %TEMP% with disguised filenames, permissions are set to executable (chmod 0755), and it is spawned detached via shell commands. The package attempts to evade detection by assembling endpoint hostnames via string splits and uses environment variables named DISABLE_TELEMETRY and DO_NOT_TRACK to disguise the behavior as telemetry. The downloaded content is unrelated to the package’s UI toolkit function and is sourced from anonymous hosts without publisher relationship or integrity verification.

If installed and executed, this package can run unauthorized and opaque binaries on the host system, potentially leading to arbitrary code execution, persistence, and further compromise. The malicious behavior is concealed as telemetry, increasing the risk of unnoticed exploitation. There is no indication that the malicious code is patched or mitigated within this version.

Avoid using version 35.3.7 of the dolyame-ui-slider package. Since no patch or official fix is indicated, users should remove this package from their dependencies and replace it with a trusted alternative. Monitor for any updates from the package publisher or security advisories for remediation. Do not rely on the package’s telemetry opt-out environment variables as they do not disable the malicious behavior.