dolyame-ui-button@35.9.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package main entrypoint.

Arbitrary attacker-controlled native code can run with the importing process user's privileges.

Remote binary staging and detached shell execution.

Requiring index.js loads _bootstrap.js inside a swallowed error handler. That module silently fetches a platform-specific binary from obfuscated Workers endpoints, or reconstructs one from DNS TXT records under wel1.ru; it writes the bytes to a temporary executable file and launches it detached through cmd.exe or /bin/sh. A timestamp file limits repeat execution and opt-out-like environment variables disguise the behavior as telemetry.

The package's import-time bootstrap is a concrete remote-code-execution chain unrelated to its declared React button functionality. Lack of an npm lifecycle hook does not mitigate execution on normal import.