The npm package dolyame-ui-tableinline version 35.8.1 contains malicious code that downloads and executes a platform-specific native binary from obfuscated and anonymous hosts. This binary is saved to disguised paths and executed in the background, enabling full-host remote code execution on any machine that installs or imports the package. The malware uses obfuscation techniques, environment variable checks for telemetry opt-out, and rate-limiting files to evade detection and re-execution. No official patch or remediation guidance is provided.