The dolyame-ui-inputsearchtagged npm package (version 35.8.1) includes a malicious _init.js script that, when the package is required, selects a platform-specific payload and downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare Workers hosts. If that fails, it uses DNS TXT lookups against several attacker-controlled domains to reassemble a base64-encoded payload. The downloaded payload is written to temporary files on Linux or Windows systems, given executable permissions, and executed detached via shell commands. Hostnames and file names are dynamically constructed to evade static analysis, and environment variables related to telemetry are checked as a cover story. There is no integrity verification or pinning of the downloaded code, allowing an attacker to execute arbitrary code on the host.

Installing or importing the affected package version results in full arbitrary code execution under attacker control on the host system. This can lead to complete compromise of the affected environment, including potential data theft, persistence, and further malicious activity.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing version 35.8.1 of dolyame-ui-inputsearchtagged. Remove the package if already installed and audit affected systems for signs of compromise. Monitor vendor advisories for any future updates or fixes. Since no patch is confirmed, exercise caution and consider using alternative trusted packages.