The npm package dolyame-ui-inputdate version 35.8.1 contains malicious code that, upon being required or imported, downloads an opaque binary from obfuscated Cloudflare Workers hosts and fallback DNS TXT record channels. The binary is saved to a hidden temporary file, made executable, and executed detached from the main process. This behavior is inconsistent with the package's stated purpose as an API client wrapper and demonstrates deliberate evasion techniques.