The npm package dolyame-ui-test version 35.2.5 contains malicious code that executes a supply-chain attack. It fetches attacker-controlled native binaries from Cloudflare Workers hosts and, if HTTPS fails, uses a DNS-TXT covert channel to retrieve payload chunks. The binaries are saved under decoy filenames in temporary directories and executed to achieve full-host remote code execution. A secondary dropper module uses obfuscated APIs under a telemetry SDK cover story. This behavior is not legitimate for a UI package and indicates a deliberate compromise.