The npm package dolyame-ui-stateutils version 35.8.1 contains malicious code that, upon import, loads a loader script which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints and fallback DNS-TXT domains. The payload is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package masquerades as a monitoring and observability SDK but its actual behavior involves stealthy payload delivery and execution. No official patch or remediation guidance is currently available.