The npm package dolyame-ui-iconspack version 35.8.1 contains malicious code that downloads and executes a platform-specific binary from suspicious external hosts unrelated to its stated functionality. It uses obfuscated techniques to evade static analysis, including splitting hostnames and API names across string fragments and retrieving payloads via DNS-TXT records. The malicious payload is saved to temporary directories, permissioned, and executed detached from the main process without any integrity verification.