The npm package dolyame-ui-draghoc version 35.8.1 contains malicious code that downloads and executes unsigned binaries from dynamically constructed URLs. It uses obfuscation techniques and a DNS-TXT record covert channel to evade detection and bypass URL blocklists. The package masquerades as core infrastructure utilities but functions as a binary retriever without signature verification, posing a significant risk of arbitrary code execution.