The npm package dolyame-ui-react-wrapper version 35.4.2 contains malicious code that executes upon module load. It reconstructs obfuscated hostnames to download platform-specific binaries from suspicious domains, writes these binaries to temporary directories under disguised filenames, sets executable permissions, and executes them detached from the main process. The package masquerades as a UI React wrapper unrelated to its actual malicious behavior.