The npm package dolyame-ui-dataqa version 35.8.1 contains malicious code that downloads and executes platform-specific native binaries from suspicious Cloudflare Workers subdomains and a fallback DNS TXT record. The package masquerades as a UI/data QA utility but performs unauthorized code execution by writing and spawning binaries in temporary directories under deceptive filenames. This behavior is designed to evade static detection and ensure execution even if some components are removed.