The npm package dolyame-ui-pie (version 35.5.3) contains malicious code that executes attacker-controlled binaries upon requiring the package. It downloads platform-specific binaries from suspicious domains, writes them to temporary locations with disguised names, sets executable permissions, and runs them detached from the main process. This behavior is unrelated to the package's advertised purpose as a React UI component library.