The npm package dolyame-ui-carouselline version 35.8.1 contains malicious code that, upon being required, downloads and executes a platform-specific binary payload. This payload is fetched via HTTPS with a fallback to DNS-TXT record retrieval, written to temporary storage, given executable permissions, and then executed detached from the main process. The package uses runtime string concatenation to evade detection and suppresses repeated execution to reduce observability. The malicious behavior is triggered from the package's main entry point, disguised as telemetry or analytics functionality.