The npm package dolyame-ui-block version 35.1.8 contains malicious code that, upon requiring its main entry, fetches and executes a remote binary payload without verification. This payload is retrieved from obfuscated Cloudflare Workers hostnames and a DNS-TXT fallback, saved to a hidden temporary file, marked executable, and launched via a detached shell process. The behavior is unrelated to the package's purported UI functionality and represents a remote code execution dropper with deliberate evasion techniques.