The npm package dolyame-ui-contextmenusearchable version 35.8.1 contains malicious code that downloads and executes a platform-specific binary from anonymous Cloudflare Workers domains. The binary is saved to temporary directories, disguised as a .NET diagnostic file, and executed in a detached process. The package uses string concatenation to hide dangerous API calls and has multiple execution paths that trigger this behavior upon import. The fetched binary's purpose is opaque, and the package falsely advertises itself as a data transformation and analytics utility.