The npm package dolyame-ui-tag version 35.9.9 contains malicious code that downloads and executes a platform-specific binary from obfuscated Cloudflare Workers hosts and uses DNS-TXT record fallback channels. The binary is saved under decoy filenames and executed detached from the main process. A secondary dropper with similar evasion techniques is also present. This behavior is consistent with a supply-chain attack delivering attacker-controlled code during package installation or require.