The npm package dolyame-ui-react-version-switch version 35.6.1 contains malicious code that downloads and executes platform-specific binaries from obfuscated external hosts. The package pretends to be a React UI helper but its main functionality is to fetch and run potentially harmful executables without integrity verification. The downloaded files are saved to temporary directories with disguised names, given executable permissions on POSIX systems, and executed detached from the main process.