The npm package dolyame-ui-selectaccount version 35.8.1 contains malicious code that downloads and executes attacker-controlled native binaries on the host system during import. The malicious code uses obfuscated hostnames and runtime string assembly to evade detection, fetches payloads without integrity checks, and executes them detached from the parent process. This behavior is disguised under the guise of an 'Analytics SDK' or 'telemetry' module but actually performs unconditional remote code execution.