The npm package dolyame-ui-inputphone version 35.8.1 contains malicious code that downloads and executes platform-specific binaries from suspicious external endpoints without verification. It uses obfuscation techniques to evade detection and executes the downloaded payloads with elevated permissions. The package masquerades as a telemetry SDK to conceal its malicious dropper behavior.