The npm package dolyame-ui-loader version 35.1.5 contains malicious code that downloads and executes an unsigned native binary from obfuscated external hosts. The package masquerades as a UI toolkit but performs unauthorized binary downloads and execution under disguised filenames and uses telemetry-related environment variables to evade detection.