The npm package dolyame-ui-storybook-menu version 35.5.6 contains malicious code that downloads and executes a remote binary upon being required. It masquerades as telemetry functionality but actually fetches a platform-specific executable from obfuscated Cloudflare Worker endpoints, writes it to disk with disguised filenames, sets execution permissions, and runs it detached. This behavior results in full remote code execution on any system importing the package.