The npm package dolyame-ui-codemods version 35.2.6 contains malicious code that executes remote code on the host. When required, it downloads a platform-specific binary from obfuscated remote hosts, writes it to a temporary directory, sets executable permissions, and runs it detached. It also uses a DNS TXT record fallback channel to retrieve payloads covertly. The package is falsely advertised as a UI toolkit and has no legitimate reason for these behaviors.