The npm package dolyame-ui-carousel version 35.3.3 contains malicious code that downloads and executes a native binary from anonymous Cloudflare Workers endpoints upon import. The package masquerades as a UI carousel component but performs unauthorized network activity to fetch and run a hidden executable in temporary directories, using obfuscated domain names and fallback covert channels. This behavior is unrelated to the package's declared functionality and indicates a supply chain compromise.