The npm package dolyame-ui-progressline version 35.8.1 contains malicious code that, upon being required, downloads and executes platform-specific binaries from hardcoded Cloudflare Workers endpoints or via DNS TXT record fallback. The payload is saved to temporary locations with deceptive names, given executable permissions, and executed detached from the main process. The package masquerades this behavior as telemetry functionality, but no legitimate telemetry occurs. The code uses string concatenation to obfuscate hostnames and API references to evade static detection. There is no official patch or fix currently documented.