The npm package dolyame-ui-eventoutside version 35.8.1 contains malicious code that downloads and executes arbitrary binaries from attacker-controlled servers. It disguises the downloaded payload as legitimate system files and executes it without user consent, enabling arbitrary code execution on any machine that installs or imports the package. This behavior is unrelated to the package's advertised functionality as API client wrappers.