The npm package dolyame-ui-chart version 35.7.2 contains malicious code that downloads and executes opaque binary payloads from anonymous Cloudflare Workers subdomains. The package uses obfuscated techniques to evade static analysis, including assembling hostnames and API names from array fragments. The downloaded binaries are saved with decoy names, given executable permissions, and executed detached from the main process. A secondary dropper is also included under the guise of an analytics SDK, which similarly decodes, sets permissions, and executes payloads. No integrity verification of the downloaded payloads is performed.