The dolyame-ui-inputautocomplete npm package version 35.8.1 includes a malicious _bootstrap.js script that dynamically selects a platform-specific path to download a native binary over HTTPS from obfuscated author-controlled domains. If the primary download fails, it reconstructs a base64 payload by enumerating DNS TXT records under sdk.dl.wel1.ru. The binary is saved to temporary locations on Unix or Windows systems, given executable permissions, and executed detached via shell commands. This results in immediate execution of attacker-controlled native code with the privileges of the user installing or requiring the package. The use of string splitting, filename masquerading as diagnostic caches, and DNS TXT reassembly are deliberate anti-analysis techniques rather than legitimate SDK behavior.

Any process that requires or imports this package immediately executes attacker-controlled native code with the installer's privileges, potentially leading to full system compromise or unauthorized actions under the user's context. The malicious code uses sophisticated evasion techniques to hinder detection and analysis.

No official patch or remediation is currently documented. Users should avoid using version 35.8.1 of dolyame-ui-inputautocomplete. Remove the package from any environments where it is installed and audit systems for signs of compromise. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.