The npm package dolyame-ui-contenteditable version 35.8.1 contains malicious code that downloads and executes attacker-controlled binaries. Upon requiring the package, it reconstructs Cloudflare Workers hostnames to fetch a binary, writes it to temporary directories with disguised names, sets executable permissions, and executes it detached. It also uses a DNS TXT record fallback channel to reassemble the binary if HTTPS egress is blocked. A secondary dropper in the telemetry module similarly downloads and executes code under the guise of an analytics SDK. The package lacks version pinning and hash verification, and employs anti-analysis techniques.