The dolyame-ui-test npm package version 35.2.5 includes malicious code that, upon module load, requires a platform-specific script which reconstructs attacker-controlled hostnames to fetch native binaries from multiple Cloudflare Workers hosts. If HTTPS fetching fails, it falls back to a DNS-TXT record covert channel under wel1.ru subdomains to reassemble base64-encoded payload chunks. The fetched binaries are saved to temporary directories with decoy filenames, permissions set to executable, and then spawned detached from the parent process. Additionally, a second dropper module in lib/telemetry.js uses obfuscated child process and filesystem APIs to perform similar fetch and execution steps under the guise of a telemetry SDK. This combination of obfuscation, fallback mechanisms, and decoy filenames fingerprints a supply-chain attack delivering full remote code execution to any system installing this package.

This malicious package enables an attacker to execute arbitrary native code on the host system with full privileges by installing the compromised npm package. The attack provides full-host remote code execution, potentially allowing complete system compromise, data theft, or further malware deployment. The use of covert DNS-TXT channels and decoy filenames complicates detection and forensic analysis.

No official patch or remediation is currently documented for this malicious package version. Users should immediately cease use and remove version 35.2.5 of dolyame-ui-test from their environments. Avoid installing or updating to this version. Monitor for any signs of compromise related to this package. Check vendor or npm advisories for updates or replacement packages. Since this is a supply-chain attack, verify the integrity of dependencies and consider using package integrity verification tools.