The npm package dolyame-ui-link version 35.8.5 contains malicious code that executes automatically upon installation. It reconstructs attacker-controlled hostnames to download platform-specific binaries, which it writes to temporary directories with disguised filenames, sets executable permissions, and executes detached processes. This behavior enables arbitrary native code execution on the host machine without user interaction.