The dolyame-ui-styles npm package version 35.1.4 includes malicious functionality in its main entry point. Upon requiring the package, it loads an obfuscated script that constructs hostnames to reach a remote server (oob-worker.cf*.workers.dev) and downloads a platform-specific binary payload. This payload is saved to a temporary directory with executable permissions and launched detached from the main process. Additionally, a covert DNS-TXT fallback mechanism retrieves the binary in chunks from DNS TXT records under *.dl.wel1.ru, reassembling it via base64 decoding. The malware uses cover-story identifiers such as 'analytics_state' and 'DISABLE_TELEMETRY' to mask its behavior and employs a TTL stamp file to control repeated execution.

This malicious package can lead to arbitrary code execution on the host system with the privileges of the user running the npm package. The covert download and execution of a binary payload can facilitate further compromise, persistence, or data exfiltration. The use of obfuscation and DNS-based fallback channels complicates detection and analysis.

No official patch or remediation guidance is provided in the available data. Users should immediately remove the affected version (=35.1.4) of dolyame-ui-styles from their environments and avoid using this package until a trusted, clean version is available. Monitor for any signs of compromise related to this package and consider scanning for the presence of the described binary artifacts and network indicators. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.