beaver-ui-form-object @35.7.3

Summary

On require of the package, index.js loads _polyfill.js whose top-level bootstrap() fetches an opaque platform-specific binary over HTTPS from string-fragment-assembled hosts (reconstructing oob-worker.cf101-adf.workers.dev and sdk.dl.wel1.ru , with a DNS-TXT fallback for endpoint discovery), writes it to /var/tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and .cache_<hex> , chmods it 755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref() (with a cmd branch on Windows). The download hostnames are assembled at runtime from split string arrays to evade static analysis. A second bundled module, lib/telemetry.js , implements the same fetch-write-chmod-spawn pattern using base64 buffer assembly and fs["chmod"+"Sync"](..., 0o755) . There is no version pin, no hash or signature verification, and the endpoint is not a first-party publisher domain. Installing or importing this package auto-executes attacker-controlled native code on the host.

Source: amazon-inspector (b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e)