The npm package dolyame-ui-inputtag version 35.8.1 contains malicious code that downloads and executes attacker-controlled binaries from obfuscated endpoints. The package masquerades as a UI input-tag component but functions as a fetch-and-execute dropper, writing binaries to temporary directories and executing them with elevated permissions. Execution is rate-limited and includes opt-out environment checks to evade detection.