The npm package dolyame-ui-inputcolor version 35.8.1 contains malicious code that executes on every import. It dynamically constructs attacker-controlled hostnames to fetch a binary payload over HTTPS or via a DNS-TXT covert channel. The payload is saved to a temporary location, given execute permissions, and run detached, allowing arbitrary code execution on the host machine.