The npm package dolyame-ui-checkbox version 35.6.9 contains malicious code that downloads and executes attacker-controlled binaries. Upon requiring the package, it reconstructs command-and-control (C2) hostnames using string-splitting and DNS TXT record techniques to evade detection. It then downloads a binary payload, saves it to temporary directories with deceptive filenames, sets executable permissions, and runs it detached from the main process. A secondary dropper disguised as an analytics SDK performs similar actions using base64-decoded payloads. These behaviors indicate a sophisticated malware dropper embedded in the package.