The npm package dolyame-ui-inputpassword version 35.8.1 contains malicious code that downloads and executes a platform-specific binary from anonymous Cloudflare Workers hosts using obfuscated techniques and a DNS-TXT covert channel fallback. The package masquerades as a UI input-password wrapper but performs unauthorized code execution unrelated to its stated purpose.