The npm package dolyame-ui-list version 35.2.6 contains malicious code that downloads and executes a platform-specific executable from untrusted Cloudflare Workers hosts and a DNS TXT fallback domain. The executable is saved to temporary directories with names mimicking legitimate diagnostic tools, given executable permissions, and run detached from the parent process. The package obfuscates hostnames and API calls and includes a secondary loader under lib/telemetry.js with identical behavior. This package impersonates a legitimate Russian BNPL vendor's UI ecosystem but exhibits no legitimate functionality.