The npm package dolyame-ui-styles version 35.1.4 contains malicious code that, when required, downloads and executes a platform-specific binary on the host system. The binary is fetched covertly using obfuscated hostnames and a DNS-TXT record fallback channel, then saved and executed with elevated permissions. The malware disguises its activity using misleading identifiers and controls re-execution via a TTL stamp file.