The npm package dolyame-ui-inputbox version 35.8.1 contains malicious code that downloads and executes platform-specific binaries from remote servers. The package uses obfuscation techniques to evade static analysis by dynamically assembling hostnames and API calls. These binaries are dropped into temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package's declared purpose is unrelated to this behavior, indicating malicious intent.