The npm package dolyame-ui-attachfile version 35.8.1 contains malicious code that, upon requiring its main entry, downloads and executes a native binary payload from multiple hardcoded external hosts. The payload is saved to temporary directories under disguised filenames, given executable permissions, and launched without user consent. The package impersonates a fintech product but functions as an anonymous native-binary loader with obfuscated code to evade detection. No patch or remediation information is currently available.