The npm package dolyame-ui-scroll version 35.4.3 contains malicious code that downloads and executes opaque binaries from author-controlled Cloudflare Workers subdomains or via a DNS-TXT covert channel. This behavior is unrelated to the package's stated UI components purpose and involves no signature or hash verification of the downloaded payloads.