The npm package dolyame-ui-avatar version 35.9.8 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts. This binary is saved under disguised names in temporary directories, given executable permissions, and run detached from the parent process without verification. The package's behavior is unrelated to its stated purpose and mimics a legitimate payment SDK to evade detection.