The npm package dolyame-ui-inputtime version 35.8.1 contains malicious code that downloads and executes platform-specific binaries from hardcoded Cloudflare Workers hosts and uses a DNS-TXT covert channel fallback. The payload is written to temporary directories under disguised filenames, given executable permissions, and executed detached from the parent process. The package masquerades as a monitoring SDK but its behavior is unrelated and malicious.