The npm package dolyame-ui-text version 35.7.4 is a malicious package masquerading as a React UI text component. Upon loading, it executes code that downloads and runs a platform-specific payload from command-and-control servers using obfuscated techniques. The payload is saved to temporary directories under decoy names and executed with elevated permissions. The package contains no legitimate UI functionality and is designed solely to deliver and execute malicious code.