The npm package dolyame-ui-lazyrender version 35.8.1 contains malicious code that, upon requiring the package, downloads and executes a hidden payload from suspicious external hosts. The payload is fetched over HTTPS from obfuscated and dynamically constructed hostnames unrelated to the package's declared purpose. The code writes the payload to a temporary file, sets executable permissions, and executes it using platform-specific shell commands without any hash or signature verification. The package uses runtime string assembly and base64 decoding to evade static detection.