The npm package dolyame-ui-toggle version 35.4.1 contains malicious code that downloads and executes an attacker-controlled binary unrelated to its declared UI toggle functionality. This binary is fetched from obfuscated endpoints, saved under disguised filenames in temporary directories, and executed with elevated permissions, enabling arbitrary code execution on affected machines.