The npm package dolyame-ui-generateid version 35.8.1 contains malicious code that, upon being required, loads a platform-specific payload from suspicious Cloudflare Workers domains. It reconstructs hostnames dynamically and uses covert DNS TXT-record fallback mechanisms to retrieve base64-encoded binary payload fragments from multiple domains. The payload is written to temporary directories under disguised filenames, given executable permissions, and executed detached from the main process. The package's stated functionality does not justify fetching and executing native binaries, indicating malicious intent. Anti-analysis techniques are employed to hinder detection and analysis.