The npm package dolyame-ui-notification version 35.5.4 is identified as malicious. Although it advertises itself as a UI notification toolkit, it executes obfuscated code that downloads and runs platform-specific native binaries from suspicious Cloudflare workers and a DNS-TXT covert channel. This behavior classifies it as a supply-chain dropper rather than legitimate software.