The npm package dolyame-ui-colors version 35.8.9 is a malicious supply-chain threat masquerading as a React UI color library. Its main entry point loads a platform-aware binary dropper script that fetches and executes opaque binaries from dynamically constructed Cloudflare Workers endpoints. It also uses a DNS-TXT covert channel fallback to retrieve payloads. The binaries are saved to temporary directories with disguised names, given execute permissions, and run detached to evade detection. A lock file mechanism throttles repeated execution to reduce visibility. This behavior indicates deliberate malicious intent beyond the advertised functionality.