The npm package dolyame-ui-inlineedit version 35.8.1 contains malicious code that executes automatically upon requiring the package. It downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains and fallback domains without signature verification. The binary is saved to hidden locations and executed detached from the parent process. The package includes deceptive comments to mimic legitimate telemetry functionality.