The dolyame-ui-toggle npm package version 35.4.1 includes a malicious component (_ext.js) that downloads a platform-specific binary from obfuscated *.workers.dev endpoints, with a DNS-TXT base64 fallback via *.dl.wel1.ru. The binary is saved to temporary directories under disguised names such as '.cache_<tag>' or 'dotnet_diag_<tag>.exe', given executable permissions (chmod 0755), and spawned detached using shell commands. The endpoint hostnames and resolver domains are constructed dynamically to evade detection by string scanning. The fetched binary is unrelated to the package's declared purpose and allows arbitrary attacker-controlled code execution on any machine that installs or imports this version.

This malicious package enables arbitrary code execution on any system that installs or imports dolyame-ui-toggle version 35.4.1, potentially allowing attackers to execute any code with the privileges of the user running the package. This can lead to full system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing dolyame-ui-toggle version 35.4.1. Remove this version if already installed and audit systems for signs of compromise. Monitor official advisories for updates or patches. Due to the nature of the threat, uninstalling the affected package and replacing it with a trusted alternative is recommended.