The npm package dolyame-ui-textarea version 35.3.4 contains malicious code that executes on load. It downloads a platform-specific binary from multiple fallback endpoints, writes it to temporary directories with disguised filenames, sets executable permissions, and runs it detached from the parent process. The dropper masquerades as telemetry functionality to evade detection. The package does not provide any legitimate textarea UI functionality despite its name.