The npm package dolyame-ui-button version 35.9.6 contains malicious code that executes arbitrary binaries on the host system. Upon module load, it downloads a platform-specific binary from obfuscated Cloudflare Workers hosts or, if that fails, reconstructs it via DNS-over-TXT queries from a covert channel. The binary is saved to temporary directories with disguised filenames, given executable permissions on Unix, and executed detached from the main process. This behavior is unrelated to the advertised UI functionality and enables the package publisher to run arbitrary code on any system importing this package.