The npm package dolyame-ui-inputcard version 35.8.1 contains malicious code that, upon being required, downloads and executes an opaque binary from obfuscated Cloudflare Workers hosts. This binary is saved to a temporary directory, given executable permissions, and run detached from the main process. The package disguises this behavior by using runtime string concatenation to evade static detection and mimics a Sentry-style APM SDK, which is unrelated to its stated UI-input-card functionality.