The npm package dolyame-ui-popup contains malicious code that, upon requiring the package, downloads and executes an unverified remote binary from attacker-controlled domains. The package does not provide any UI code as advertised but instead performs stealthy binary drops and execution using obfuscated code to evade detection. This behavior poses a significant risk of remote code execution on affected systems.