dolyame-ui-chart@35.7.2

High-risk behavior combination matched malicious policy.

Runtime import/require of index.js

Arbitrary remote code executes with the importing process user's permissions.

Remote binary download, temporary-file drop, and detached execution

On import, index.js silently requires _shim.js. The shim selects a platform payload, fetches it from rotated workers.dev hosts or DNS TXT records, writes it under a temporary directory, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The payload is not authenticated or package-owned, enabling remote operator code execution.

This is a concrete import-time staged-payload chain, not ordinary telemetry. The package's advertised chart API does not require or expose this behavior.