The npm package dolyame-ui-confirmation version 35.3.3 contains malicious code that downloads and executes an attacker-controlled native binary on the host machine during module import. The package disguises this behavior by obfuscating download URLs and using decoy filenames, inconsistent with its stated React-UI purpose. This supply-chain dropper executes the binary detached from the main process, potentially compromising the host system.