form-bnpl-dolyame-component-object@20.8.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of the package.

Arbitrary remote code executes under the consuming application's user account.

Import-time HTTPS/DNS payload download, temp-file drop, chmod, and detached process execution.

The public entrypoint silently loads _polyfill.js. At import time it retrieves a large binary from obfuscated Workers hosts or DNS TXT records, writes it to /var/tmp or the Windows temp directory, marks it executable on Unix, and starts it through a detached shell or cmd.exe process. The loader is unrelated to the advertised minimal form-component API and masks errors.

Concrete import-time download-and-execute behavior establishes malware, independent of the scanner label. The lack of lifecycle hooks does not mitigate execution when consumers load the package.