The npm package dolyame-ui-inputcount version 35.8.1 contains malicious code that, upon being required, downloads and executes a platform-specific binary from obfuscated Cloudflare Worker endpoints. The package uses string fragment assembly and other obfuscation techniques to evade detection. It writes the binary to temporary directories with executable permissions and spawns it detached from the main process. The package masquerades as an analytics or observability SDK but has no legitimate reason to fetch and run opaque binaries at import time.