The npm package dolyame-ui-menu, advertised as a React UI component library, contains malicious code that downloads and executes a platform-specific native binary from attacker-controlled hosts. The malicious payload is fetched using obfuscated runtime-assembled hostnames and a DNS-TXT fallback channel, then saved to temporary directories with disguised filenames and executed without signature verification. Execution is conditionally gated by environment variables and filesystem markers to evade detection and analysis. The package version 35.6.1 is affected.