The npm package dolyame-ui-swiper version 35.7.7 contains malicious code that executes arbitrary remote code on the host system upon installation or require(). It downloads and runs an opaque native binary from obfuscated Cloudflare Workers subdomains and a fallback domain, disguises the binary with a hidden filename, sets executable permissions, and spawns it detached. This behavior is unrelated to the package's advertised UI functionality and occurs without verification or pinning of the downloaded binary.