The npm package dolyame-ui-contextmenu version 35.8.1 contains malicious code that downloads and executes attacker-controlled binaries from anonymous Cloudflare Workers subdomains. The package uses obfuscation techniques to evade detection, including assembling hostnames from fragments and employing a base64-over-DNS-TXT covert channel to fetch payloads when HTTPS is blocked. The downloaded binaries are executed on the host system with elevated permissions, posing a significant security risk.