The npm package dolyame-ui-checkable version 35.4.1 contains malicious code that executes automatically upon import. It downloads and executes platform-specific binaries from Cloudflare workers.dev mirrors or via a DNS TXT record covert channel, enabling execution of a dropper binary designed to bypass HTTPS egress filtering. The package disguises its malicious behavior under the guise of a UI utility, using obfuscation techniques and a secondary dropper embedded in telemetry code. No patch or remediation information is currently available.