The npm package 'checkout-mobile-dolyame' version 35.7.4 is identified as malicious. Upon import, it downloads and executes arbitrary attacker-supplied code by fetching an OS/architecture-specific binary from obfuscated Cloudflare worker URLs and fallback DNS TXT record channels. The payload is saved under disguised filenames in temporary directories and executed without any integrity verification. This package masquerades as legitimate Dolyame checkout tooling but performs unauthorized code execution.