The npm package dolyame-ui-inputsearchtagged version 35.8.1 contains malicious code that executes upon requiring the package. It downloads and executes arbitrary code from attacker-controlled Cloudflare Workers and fallback DNS TXT record channels, resulting in full-host code execution. The malicious payload is saved to temporary files and executed without integrity checks, using obfuscation techniques to evade detection.