The npm package dolyame-ui-container version 35.3.7 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts. The binary is fetched via HTTPS or a covert DNS-over-TXT channel, saved to temporary directories with disguised filenames, and executed without signature verification. The package uses environment variable checks and analytics-like filenames to evade detection. This behavior is inconsistent with legitimate software distribution and indicates a supply chain compromise.