checkout-mobile-dolyame@35.7.4

High-risk behavior combination matched malicious policy.

Any application requiring index.js

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download, drop, chmod, and detached execution

Requiring the package loads _loader.js. Unless opt-out variables or a short-lived stamp prevent it, the loader retrieves a platform-specific payload from rotating Workers hosts or DNS TXT chunks, writes it under /var/tmp or the Windows temp directory, marks it executable on Unix, and starts it detached through a shell or cmd.exe.

The entrypoint reaches an automatic remote native-payload execution chain; it is unrelated to the documented minimal device-integration API. Lack of an npm lifecycle hook does not mitigate import-time code execution.