The npm package dolyame-ui-scrollblock version 35.8.1 contains malicious code that, when imported, downloads and executes attacker-controlled native binaries on the developer's machine. The package uses obfuscated code to reconstruct Cloudflare Workers hostnames and fetch platform-specific payloads, which are saved to temporary directories, given executable permissions, and run detached. A secondary payload delivery method uses DNS TXT record resolution to assemble and execute base64-encoded code. This behavior occurs without any signature verification or pinning, posing a direct risk of remote code execution upon package installation and import.