The npm package dolyame-ui-inputmoney version 35.8.1 contains malicious code that, upon requiring the package, downloads and executes a platform-specific binary from suspicious Cloudflare Worker hostnames. If these endpoints are unreachable, it uses a DNS TXT record covert channel to fetch and execute a payload from multiple suspicious domains. The malicious binary is saved under system-like filenames and executed detached from the main process. The code employs obfuscation techniques to evade static detection and does not verify the integrity of the fetched payload.