The npm package dolyame-ui-flag version 35.7.6 contains malicious code that downloads and executes platform-specific native binaries from anonymous Cloudflare Workers hosts. These binaries are saved to temporary directories under disguised names and executed in a detached manner. The package's advertised functionality as a UI flag component is unrelated to this behavior. A secondary dropper with identical behavior is embedded in a telemetry module labeled as an 'Analytics SDK'.