The npm package dolyame-ui-stepper version 35.7.5 contains malicious code that executes automatically upon import. It downloads a native binary from obfuscated external hosts, saves it under a disguised filename resembling a Microsoft diagnostic tool, sets executable permissions, and runs it detached without user interaction. A secondary dropper with similar behavior is present but not currently reachable. This behavior poses a risk of unauthorized code execution on the host system.