The npm package dolyame-ui-types version 35.8.2 contains malicious code that downloads and executes a platform-specific binary from hardcoded external URLs. This behavior is unexpected for a type-definitions library, which normally does not perform network operations or execute binaries. The package reconstructs destination hostnames at runtime to evade detection and writes the downloaded binary to disguised file paths before executing it detached from the parent process.