dolyame-ui-portal@35.3.6

High-risk behavior combination matched malicious policy.

Runtime import/require of dolyame-ui-portal

Arbitrary remote native code execution under the importing user's privileges.

import-time remote binary download and detached execution

When an application imports the package, index.js silently requires _bridge.js. That module runs main(), downloads an opaque platform-specific payload from hard-coded worker hosts or DNS TXT records, writes it to a temporary file, marks it executable on Unix, and launches it detached. This is concealed remote payload execution with no relation to the documented UI toolkit.

The import-time downloader-to-execution chain is concrete and unconditional apart from opt-out/short-lived stamp checks. No lifecycle script is needed because the malicious code executes on normal package import.