The dolyame-ui-sortablelist npm package version 35.8.1 includes malicious functionality that triggers on require(). It fetches a platform-specific executable from obfuscated Cloudflare Workers domains or reconstructs it from DNS TXT records hosted under several 'dl.wel1.ru' subdomains. The binary is saved to a temporary file with a name resembling OS diagnostic files, permissions are set to executable, and it is spawned detached via a shell command. This drop-and-execute logic is redundantly implemented in multiple package files to ensure execution. The package uses string concatenation and bracket notation to evade static detection of 'child_process' and 'fs.chmodSync'. It masquerades as telemetry/analytics software and uses environment variables related to telemetry opt-out as a cover to conceal its malicious behavior. This results in silent execution of attacker-controlled code on the host system at import time.

This malicious package enables remote code execution on the host system at the time the package is imported, allowing an attacker to run arbitrary code with the privileges of the importing process. The execution is stealthy, using obfuscated network hosts and disguising the binary as system diagnostics files. This can lead to full system compromise, data theft, or further malware deployment. There are no known exploits in the wild reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fixed version or official guidance is available, avoid using version 35.8.1 of dolyame-ui-sortablelist. Remove the package from your environment if already installed. Monitor for updates from the package maintainers or npm security advisories for remediation. Consider scanning your environment for the presence of this package and any suspicious binaries matching the described patterns.