The npm package dolyame-ui-react-dom-wrapper version 35.8.9 contains malicious code that, when required, downloads and executes attacker-controlled binaries on the host system. The package fetches opaque binaries from multiple attacker-controlled domains, writes them to temporary directories with disguised filenames, sets executable permissions, and runs them detached from the main process. This behavior occurs via obfuscated runtime string assembly to evade static detection. Any installer or user requiring this package risks executing arbitrary code with their privileges.