The npm package dolyame-ui-focusstatehoc version 35.8.1 contains malicious code that downloads and executes platform-specific binaries from obfuscated Cloudflare Workers subdomains and fallback domains. The binaries are saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package uses obfuscation techniques to evade detection, including runtime string concatenation and environment variable-based opt-out mechanisms. Additionally, it executes a base64-encoded payload at load time, providing a second remote code execution vector.