The npm package dolyame-ui-footer version 35.5.8 contains malicious code that, when required, loads a runtime script which fetches a binary payload from hardcoded Cloudflare Workers hosts. The payload is reconstructed using DNS TXT records from specific domains and executed on the host system, disguising itself as a UI/footer component. This behavior is unexpected given the package's declared purpose and indicates a supply chain compromise.