dolyame-ui-codemods@35.2.6

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js

Arbitrary native code execution under the importing user's privileges.

remote payload download, temporary-file drop, and detached execution

index.js suppresses errors while requiring _polyfill.js, so ordinary package import starts its async loader. The loader tries obfuscated HTTPS hosts for a platform-specific executable and falls back to base64 payload chunks fetched through DNS TXT records. It writes the payload to a randomized temporary filename, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. This is an unconsented staged remote-code-execution chain.

The import-time downloader and detached execution are concrete malicious behavior, not telemetry. The unused telemetry implementation contains the same native-payload pattern and reinforces intent.