The npm package dolyame-ui-skeleton, advertised as a UI components library, contains malicious code that downloads and executes platform-specific native binaries at load time. It uses obfuscated Cloudflare Workers hosts and a covert DNS TXT query channel to fetch payloads, evading static analysis and HTTPS egress filtering. This behavior is unusual and unjustified for a UI component package, indicating malicious intent.