The npm package dolyame-ui-deprecatepropshoc version 35.8.1 contains malicious code that executes automatically when required. It downloads and executes a platform-specific binary without any verification, enabling remote code execution on the host system. The malicious payload is disguised under telemetry-related filenames and is triggered even if some components are removed.