The npm package dolyame-ui-breadcrumbs version 35.6.5 contains malicious code that, upon being required, dynamically reconstructs command-and-control hostnames and fetches a binary payload from attacker-controlled servers. This payload is saved to disk under disguised filenames and executed with full remote code execution capabilities on the host system. The malicious behavior includes platform-specific execution methods and persistence markers, enabling an attacker to run arbitrary code on the installer's machine.