The npm package dolyame-ui-cardlogo version 35.8.1 contains malicious code that, upon loading, downloads and executes a platform-specific binary from dynamically constructed and obfuscated external hostnames. The binary is saved under disguised filenames in temporary directories and executed detached from the main process. The package uses misleading telemetry-related function names to conceal this behavior, which is unrelated to its stated UI functionality.