beaver-ui-grid @34.6.4

Summary

On any require of the package, index.js loads _polyfill.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback under *.dl.wel1.ru. Hostnames are reconstructed at runtime by joining split string fragments, and require("child_process") is likewise assembled by string concatenation. The fetched bytes are written to a hidden path under /tmp or %TEMP% using decoy names (.cache_<rand> or dotnet_diag_<rand>.exe), chmod 0o755, and detached-spawned via /bin/sh -c or cmd.exe start /b. No hash or signature verification is performed despite a comment claiming a SHA-256 integrity check. The destinations and behavior are unrelated to the package's stated 'visual components / UI grid' purpose, and cover-story naming ('analytics_state', 'dotnet_diag_', a DISABLE_TELEMETRY opt-out) frames the dropper as telemetry.

Source: amazon-inspector (b077d7cccabfb111781dd4296e0c72efdcd424188ea7b1e1de96acb884c6579c)