The npm package dolyame-ui-money version 35.6.1 contains malicious code that downloads and executes a platform-specific native binary from obfuscated Cloudflare Workers hosts. This binary is saved to temporary directories and executed with the installer's privileges on every require() call. The package's stated purpose as a React UI toolkit is unrelated to this behavior. The code uses hostname obfuscation, covert DNS-TXT channels, and evasion techniques to avoid detection and analysis, indicating hostile intent.