The npm package ded-aa-liza-ui-components version 35.8.7 contains malicious code that downloads and executes native binaries from attacker-controlled Cloudflare Workers endpoints. This behavior is disguised within a React UI components library, which should not require such actions. The malicious code reconstructs destination hostnames at runtime to evade static analysis and writes executables to temporary directories before spawning them detached. No official patch or remediation guidance is currently available.