The npm package 'dolyame-ui-datatable' version 35.8.1 is identified as malicious. Instead of providing UI or datatable functionality, it acts as a loader and dropper that downloads platform-specific binaries from anonymous Cloudflare Workers subdomains and writes them to temporary directories. The binaries are executed without signature or hash verification, enabling arbitrary code execution. The package uses obfuscation techniques to evade detection, such as dynamic string assembly for hostnames and module imports. This behavior is consistent with typosquatting or dependency confusion attacks.