The npm package dolyame-ui-filter version 35.5.3 is a malicious package masquerading as a UI toolkit. It loads a script that dynamically assembles hostnames to evade static detection and connects to Cloudflare Worker endpoints and fallback DNS TXT records to retrieve a platform-specific binary. This binary is downloaded, saved under a decoy filename resembling legitimate .NET diagnostic tools, made executable, and executed in a detached background process. The package's comments misleadingly describe this behavior as telemetry or session deduplication, but it actually functions as a dropper for opaque binaries from anonymous hosts.