The npm package dolyame-ui-popupcarousel version 35.8.1 contains malicious code that executes on import. It downloads platform-specific native binaries from rotating anonymous Cloudflare Workers hosts and a fallback domain, writes them to temporary directories under decoy filenames, sets executable permissions, and spawns them detached. This behavior allows arbitrary code execution on the host system under the guise of a telemetry SDK.