The npm package dolyame-ui-inputfio version 35.8.1 contains malicious code that executes immediately upon import. It reconstructs obfuscated hostnames to download a binary payload via HTTPS or DNS TXT fallback, writes this payload to temporary disk locations, sets executable permissions, and executes it detached using system shell commands. The package disguises this behavior as an analytics SDK but includes deliberate evasion techniques to avoid static detection.