The npm package dolyame-ui-checkablegroup contains malicious code that executes a dropper upon being required. This dropper dynamically constructs obfuscated hostnames to download a binary payload, which it saves under spoofed Microsoft diagnostic tool names and executes detached on the host system. It also uses a covert DNS-TXT fallback channel to receive additional payload data. No integrity verification of the downloaded payload is performed. This behavior is consistent with malware disguised as a UI helper package.