The npm package dolyame-ui-inputautocomplete version 35.8.1 contains malicious code that executes attacker-controlled native binaries upon require/import. It downloads platform-specific native payloads from obfuscated author-controlled hosts and uses DNS TXT record enumeration to reconstruct a fallback payload. The payload is saved to temporary directories and executed with the installer's privileges, employing anti-analysis techniques such as string splitting and filename masquerading.