The npm package dolyame-ui-tabslayout version 35.8.1 contains malicious code that acts as a dropper. Upon requiring the package, it loads scripts that select an OS-specific payload, fetch a binary from obfuscated Cloudflare Workers URLs or a DNS TXT record fallback, writes the payload to a temporary path with deceptive filenames, sets executable permissions, and executes it detached from the main process. The package disguises itself as build or deployment tooling and mimics a Sentry-style analytics SDK to evade detection.