The npm package dolyame-ui-island version 35.7.4 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts and fallback DNS-TXT base64 channels. The binary is saved to a randomized temporary path, given executable permissions, and executed detached from the main process. The package falsely impersonates a payments UI library but contains no legitimate functionality related to payments.