The npm package dolyame-ui-pagination version 35.2.5 contains malicious code that executes a dropper routine upon requiring the package. This dropper dynamically assembles hostnames to evade detection and downloads platform-specific binaries from Cloudflare Workers endpoints, saving them under disguised names and executing them. If the primary download fails, a covert channel retrieves executable code via DNS TXT records from suspicious domains. The malicious behavior is unrelated to the package's stated UI pagination functionality and involves executing opaque fetched code.