The npm package dolyame-ui-action version 35.6.3 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. The binary is saved to temporary directories under disguised filenames, made executable, and launched detached from the main process. The package uses obfuscation techniques including runtime hostname reconstruction and swallow-all try/catch wrappers to evade detection. An alternate execution path exists via a bundled telemetry module that also facilitates binary dropping and execution. No official patch or remediation guidance is currently available.