The npm package dolyame-ui-utils version 35.6.7 contains malicious code that, upon requiring the package, downloads and executes an opaque binary from obfuscated Cloudflare Workers hosts without any integrity verification. This binary is saved to temporary directories and executed detached from the main process. Additional evasion techniques are employed in a parallel dropper implementation within the package. The malicious activity is disguised using telemetry markers and environment variables.