The npm package dolyame-ui-calendar version 35.1.8 contains malicious code that, upon requiring its main module, downloads and executes opaque binaries from obfuscated Cloudflare Workers hosts or via DNS TXT record covert channels. This behavior includes writing executables to hidden temporary files, setting executable permissions, and spawning these binaries detached from the main process. The package disguises this malicious activity behind telemetry and analytics-like code to evade detection. No CVSS score is available for this threat.