The npm package dolyame-ui-icon version 35.7.5 contains malicious code that executes arbitrary binaries on the host system upon module load. It downloads platform-specific binaries from obfuscated Cloudflare Workers endpoints, writes them to temporary locations with decoy names, sets executable permissions, and spawns them detached via shell commands. A DNS TXT-record covert channel serves as a fallback to deliver payloads. The package also includes a disguised telemetry component that replicates these dropper behaviors. This results in arbitrary code execution on the installer's host.