The dolyame-ui-tag npm package version 35.9.9 includes malicious functionality in its index.js and lib/telemetry.js files. On require, it downloads a platform-specific binary from multiple obfuscated Cloudflare Workers URLs constructed at runtime, with a DNS-TXT covert-channel fallback via subdomains of dl.wel1.ru for environments blocking HTTPS. The binary is saved under decoy names (dotnet_diag_*.exe on Windows, .cache_* on Unix), permissions are set to executable, and it is spawned detached using child process commands. The secondary dropper uses string concatenation to evade static analysis. These techniques indicate a supply-chain compromise delivering attacker-controlled code to any machine that installs or requires this package.

This malicious package enables execution of attacker-controlled binaries on the host system during package installation or require, potentially leading to full system compromise or further payload delivery. The use of obfuscation, fallback channels, and detached execution complicates detection and mitigation. No known exploits in the wild are reported yet, but the presence of such code in a supply-chain dependency poses a significant risk to developers and production environments using this package version.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring dolyame-ui-tag version 35.9.9. Remove the package from existing environments and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals. Employ supply-chain security best practices such as verifying package integrity and using trusted sources.